Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Project: waffle-jetty

Scan Information (show all):

Display: Showing Vulnerable Dependencies (click to show all)

Dependency CPE GAV Highest Severity CVE Count CPE Confidence Evidence Count
guava-18.0.jar com.google.guava:guava:18.0   0 18
javax.annotation-api-1.2.jar javax.annotation:javax.annotation-api:1.2   0 21
javax.el-api-3.0.1-b04.jar javax.el:javax.el-api:3.0.1-b04   0 20
javax.servlet-api-3.1.0.jar javax.servlet:javax.servlet-api:3.1.0   0 21
javax.servlet.jsp-api-2.3.2-b01.jar cpe:/a:oracle:jsp:2.3.2.b01 javax.servlet.jsp:javax.servlet.jsp-api:2.3.2-b01   0 LOW 19
jstl-api-1.2.jar javax.servlet.jsp.jstl:jstl-api:1.2   0 12
javax.transaction-api-1.2.jar javax.transaction:javax.transaction-api:1.2   0 21
javax.websocket-api-1.0.jar javax.websocket:javax.websocket-api:1.0   0 18
jna-platform-4.1.0.jar net.java.dev.jna:jna-platform:4.1.0   0 21
jna-4.1.0.jar net.java.dev.jna:jna:4.1.0   0 23
jna-4.1.0.jar: jnidispatch.dll   0 1
jna-4.1.0.jar: jnidispatch.dll   0 1
jna-4.1.0.jar: jnidispatch.dll   0 1
ecj-4.4.2.jar org.eclipse.jdt.core.compiler:ecj:4.4.2   0 15
http2-hpack-9.3.0.v20150612.jar cpe:/a:jetty:jetty:9.3.0.v20150612 org.eclipse.jetty.http2:http2-hpack:9.3.0.v20150612   0 LOW 15
http2-server-9.3.0.v20150612.jar cpe:/a:jetty:jetty:9.3.0.v20150612
cpe:/a:jetty:jetty_http_server:9.3.0.v20150612
org.eclipse.jetty.http2:http2-server:9.3.0.v20150612   0 LOW 15
jetty-io-9.3.0.v20150612.jar cpe:/a:jetty:jetty:9.3.0.v20150612 org.eclipse.jetty:jetty-io:9.3.0.v20150612   0 LOW 14
javax.activation-1.1.0.v201105071233.jar cpe:/a:jetty:jetty:1.1.0.v20110507 org.eclipse.jetty.orbit:javax.activation:1.1.0.v201105071233   0 LOW 15
javax.mail.glassfish-1.4.1.v201005082020.jar cpe:/a:jetty:jetty:1.4.1.v20100508 org.eclipse.jetty.orbit:javax.mail.glassfish:1.4.1.v201005082020   0 LOW 15
javax.security.auth.message-1.0.0.v201108011116.jar cpe:/a:jetty:jetty:1.0.0.v20110801 org.eclipse.jetty.orbit:javax.security.auth.message:1.0.0.v201108011116   0 LOW 19
javax-websocket-client-impl-9.3.0.v20150612.jar cpe:/a:jetty:jetty:9.3.0.v20150612 org.eclipse.jetty.websocket:javax-websocket-client-impl:9.3.0.v20150612   0 LOW 14
websocket-api-9.3.0.v20150612.jar cpe:/a:jetty:jetty:9.3.0.v20150612 org.eclipse.jetty.websocket:websocket-api:9.3.0.v20150612   0 LOW 15
javax.el-3.0.1-b08.jar org.glassfish:javax.el:3.0.1-b08   0 24
javax.servlet.jsp.jstl-1.2.4.jar cpe:/a:oracle:glassfish:1.2.4
cpe:/a:oracle:glassfish_server:1.2.4
org.glassfish.web:javax.servlet.jsp.jstl:1.2.4 Medium 3 LOW 26
javax.servlet.jsp-2.3.3-b02.jar cpe:/a:oracle:jsp:2.3.3.b02 org.glassfish.web:javax.servlet.jsp:2.3.3-b02   0 LOW 20
asm-commons-5.0.1.jar org.ow2.asm:asm-commons:5.0.1   0 19
asm-tree-5.0.1.jar org.ow2.asm:asm-tree:5.0.1   0 19
asm-5.0.1.jar org.ow2.asm:asm:5.0.1   0 18
jcl-over-slf4j-1.7.12.jar org.slf4j:jcl-over-slf4j:1.7.12   0 17
slf4j-api-1.7.12.jar org.slf4j:slf4j-api:1.7.12   0 17

Dependencies

guava-18.0.jar

Description:  Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: C:\Users\Jeremy\.m2\repository\com\google\guava\guava\18.0\guava-18.0.jar
MD5: 947641f6bb535b1d942d1bc387c45290
SHA1: cce0823396aa693798f8882e64213b1772032b09
Referenced In Project: waffle-jetty

Identifiers

javax.annotation-api-1.2.jar

Description: Common Annotations for the JavaTM Platform API

License:

CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\javax\annotation\javax.annotation-api\1.2\javax.annotation-api-1.2.jar
MD5: 75fe320d2b3763bd6883ae1ede35e987
SHA1: 479c1e06db31c432330183f5cae684163f186146
Referenced In Project: waffle-jetty

Identifiers

javax.el-api-3.0.1-b04.jar

Description: Expression Language 3.0 API

License:

CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\javax\el\javax.el-api\3.0.1-b04\javax.el-api-3.0.1-b04.jar
MD5: fe9f96efeb44172a4e8a54a81c93f39d
SHA1: 8c0c970b8deae5054ff0bf4b17979c8181a506d3
Referenced In Project: waffle-jetty

Identifiers

javax.servlet-api-3.1.0.jar

Description: Java(TM) Servlet 3.1 API Design Specification

License:

CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\javax\servlet\javax.servlet-api\3.1.0\javax.servlet-api-3.1.0.jar
MD5: 79de69e9f5ed8c7fcb8342585732bbf7
SHA1: 3cd63d075497751784b2fa84be59432f4905bf7c
Referenced In Project: waffle-jetty

Identifiers

javax.servlet.jsp-api-2.3.2-b01.jar

Description: Java.net - The Source for Java Technology Collaboration

License:

CDDL + GPLv2 with classpath exception: http://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\javax\servlet\jsp\javax.servlet.jsp-api\2.3.2-b01\javax.servlet.jsp-api-2.3.2-b01.jar
MD5: c02166e3637f58f6625d2e62b46c9247
SHA1: 070de11e93085f225d04803e14ee76b93744f5f4
Referenced In Project: waffle-jetty

Identifiers

jstl-api-1.2.jar

File Path: C:\Users\Jeremy\.m2\repository\javax\servlet\jsp\jstl\jstl-api\1.2\jstl-api-1.2.jar
MD5: 7fe4f9829d305ef5b257bfc52e0e97db
SHA1: f9a034c1ca1f79c03bb461805a688f944544d138
Referenced In Project: waffle-jetty

Identifiers

javax.transaction-api-1.2.jar

Description: Project GlassFish Java Transaction API

License:

CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\javax\transaction\javax.transaction-api\1.2\javax.transaction-api-1.2.jar
MD5: 2dfee184286530e726ad155816e15b4c
SHA1: d81aff979d603edd90dcd8db2abc1f4ce6479e3e
Referenced In Project: waffle-jetty

Identifiers

javax.websocket-api-1.0.jar

Description: JSR 356: Java API for WebSocket

License:

https://glassfish.java.net/public/CDDL+GPL_1_1.html
File Path: C:\Users\Jeremy\.m2\repository\javax\websocket\javax.websocket-api\1.0\javax.websocket-api-1.0.jar
MD5: 510563ac69503be2d6cbb6d492a8027b
SHA1: fc843b649d4a1dcb0497669d262befa3918c7ba8
Referenced In Project: waffle-jetty

Identifiers

jna-platform-4.1.0.jar

Description: Java Native Access Platform

License:

LGPL, version 2.1: http://www.gnu.org/licenses/licenses.html
ASL, version 2: http://www.apache.org/licenses/
File Path: C:\Users\Jeremy\.m2\repository\net\java\dev\jna\jna-platform\4.1.0\jna-platform-4.1.0.jar
MD5: 533e404eda70bbf8e40de134ffeec95b
SHA1: 23457ad1cf75c2c16763330de5565a0e67b4bc0a
Referenced In Project: waffle-jetty

Identifiers

jna-4.1.0.jar

Description: Java Native Access

License:

LGPL, version 2.1: http://www.gnu.org/licenses/licenses.html
ASL, version 2: http://www.apache.org/licenses/
File Path: C:\Users\Jeremy\.m2\repository\net\java\dev\jna\jna\4.1.0\jna-4.1.0.jar
MD5: b0e08c9936dc52aa40439c71fcad6297
SHA1: 1c12d070e602efd8021891cdd7fd18bc129372d4
Referenced In Project: waffle-jetty

Identifiers

jna-4.1.0.jar: jnidispatch.dll

File Path: C:\Users\Jeremy\.m2\repository\net\java\dev\jna\jna\4.1.0\jna-4.1.0.jar\com\sun\jna\w32ce-arm\jnidispatch.dll
MD5: 57697cbdd321ae7d06f5da04e821f908
SHA1: 67167f2b2fce8db5f9f64a372b0da54730d3ee51

Identifiers

  • None

jna-4.1.0.jar: jnidispatch.dll

File Path: C:\Users\Jeremy\.m2\repository\net\java\dev\jna\jna\4.1.0\jna-4.1.0.jar\com\sun\jna\win32-x86-64\jnidispatch.dll
MD5: 06b2f1f909d2436dff20d7a668ef26a9
SHA1: bd1bdda9a91f3b0d9067e323f7394bef933f81f6

Identifiers

  • None

jna-4.1.0.jar: jnidispatch.dll

File Path: C:\Users\Jeremy\.m2\repository\net\java\dev\jna\jna\4.1.0\jna-4.1.0.jar\com\sun\jna\win32-x86\jnidispatch.dll
MD5: 05a72ada9247aeb114a9ef01a394b6c4
SHA1: 8b32cc82740fc62afdf5ea211f1ca8bb72269bbf

Identifiers

  • None

ecj-4.4.2.jar

Description: Eclipse JDT Core Batch Compiler

License:

Eclipse Public License v1.0: http://www.eclipse.org/org/documents/epl-v10.php
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jdt\core\compiler\ecj\4.4.2\ecj-4.4.2.jar
MD5: ee97ab38f390547839b950bb51bf5cb5
SHA1: 71d67f5bab9465ec844596ef844f40902ae25392
Referenced In Project: waffle-jetty

Identifiers

http2-hpack-9.3.0.v20150612.jar

Description: Jetty module for Jetty :: HTTP2 :: HPACK

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\http2\http2-hpack\9.3.0.v20150612\http2-hpack-9.3.0.v20150612.jar
MD5: 40fb6941c08816746cd9409d590cf45e
SHA1: 2939212572cbbce6d8a1aae184b9cf33af4f0c85
Referenced In Project: waffle-jetty

Identifiers

http2-server-9.3.0.v20150612.jar

Description: Jetty module for Jetty :: HTTP2 :: Server

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\http2\http2-server\9.3.0.v20150612\http2-server-9.3.0.v20150612.jar
MD5: 42001c06371564079809c5d8c854cd8e
SHA1: 1d2cfd3baedcea2e81ad46e0b83c2ee135dd90eb
Referenced In Project: waffle-jetty

Identifiers

jetty-io-9.3.0.v20150612.jar

Description: Jetty module for Jetty :: IO Utility

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\jetty-io\9.3.0.v20150612\jetty-io-9.3.0.v20150612.jar
MD5: a45f096d55c2a1b4efa108d292af91f2
SHA1: f656fc8a5daaeb180431014b9dc01b205d4ab21e
Referenced In Project: waffle-jetty

Identifiers

javax.activation-1.1.0.v201105071233.jar

Description:  This artifact originates from the Orbit Project at Eclipse, it is an osgi bundle and is signed as well.

File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\orbit\javax.activation\1.1.0.v201105071233\javax.activation-1.1.0.v201105071233.jar
MD5: 1402e9e48aa8bd79196b9a509be492ea
SHA1: b394a9fbf664ca835452b3ced452710bcf79fd81
Referenced In Project: waffle-jetty

Identifiers

javax.mail.glassfish-1.4.1.v201005082020.jar

Description:  This artifact originates from the Orbit Project at Eclipse, it is an osgi bundle and is signed as well.

File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\orbit\javax.mail.glassfish\1.4.1.v201005082020\javax.mail.glassfish-1.4.1.v201005082020.jar
MD5: 4338c1dd7b00b31633ca1067d0685255
SHA1: b707c39fc080529c4a9ffc1df4eac58421133aaf
Referenced In Project: waffle-jetty

Identifiers

javax.security.auth.message-1.0.0.v201108011116.jar

Description:  This artifact originates from the Orbit Project at Eclipse, it is an osgi bundle and is signed as well.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\orbit\javax.security.auth.message\1.0.0.v201108011116\javax.security.auth.message-1.0.0.v201108011116.jar
MD5: 4d19b63b9722a19e19f5d374b3cec353
SHA1: 864ac89e01622b020fa2104bfda379692146b3b6
Referenced In Project: waffle-jetty

Identifiers

javax-websocket-client-impl-9.3.0.v20150612.jar

Description: javax.websocket.client Implementation

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\websocket\javax-websocket-client-impl\9.3.0.v20150612\javax-websocket-client-impl-9.3.0.v20150612.jar
MD5: 9b4ce8cabb8a3a799acfe948c8baf971
SHA1: b693ca672f6c5b2b86c71243d905a3f583e3e8fe
Referenced In Project: waffle-jetty

Identifiers

websocket-api-9.3.0.v20150612.jar

Description: Jetty module for Jetty :: Websocket :: API

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: C:\Users\Jeremy\.m2\repository\org\eclipse\jetty\websocket\websocket-api\9.3.0.v20150612\websocket-api-9.3.0.v20150612.jar
MD5: 39600569d3ea428440cda296c01cccaf
SHA1: d3a4607cbf60d1109a073f995d08fb20c389b22d
Referenced In Project: waffle-jetty

Identifiers

javax.el-3.0.1-b08.jar

Description: Expression Language 3.0 API and Implementation

License:

CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\org\glassfish\javax.el\3.0.1-b08\javax.el-3.0.1-b08.jar
MD5: 08a27292a55062a60ccd558f780a61e2
SHA1: 8fa39d3901fc6ec8c0fff4ad4e48c26c4911c422
Referenced In Project: waffle-jetty

Identifiers

javax.servlet.jsp.jstl-1.2.4.jar

Description: Java.net - The Source for Java Technology Collaboration

License:

CDDL + GPLv2 with classpath exception: http://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\org\glassfish\web\javax.servlet.jsp.jstl\1.2.4\javax.servlet.jsp.jstl-1.2.4.jar
MD5: 48317e0c4995b8cc81a0d932f3156cf2
SHA1: b2a7ae6962d3164f85196b1b3f4535c83e98dce5
Referenced In Project: waffle-jetty

Identifiers

CVE-2015-2808  

Severity: Medium
CVSS Score: 4.3
CWE: CWE-310 Cryptographic Issues

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Vulnerable Software & Versions: (show all)

CVE-2013-2566  

Severity: Medium
CVSS Score: 4.3
CWE: CWE-310 Cryptographic Issues

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.

Vulnerable Software & Versions: (show all)

CVE-2011-5035  

Severity: Medium
CVSS Score: 5.0
CWE: CWE-20 Improper Input Validation

Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.

Vulnerable Software & Versions: (show all)

javax.servlet.jsp-2.3.3-b02.jar

Description: Java.net - The Source for Java Technology Collaboration

License:

CDDL + GPLv2 with classpath exception: http://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: C:\Users\Jeremy\.m2\repository\org\glassfish\web\javax.servlet.jsp\2.3.3-b02\javax.servlet.jsp-2.3.3-b02.jar
MD5: 50a0d058ef823766a0955eada9293c46
SHA1: 6c48c79f702c0934b450c206445a2126bb2e4def
Referenced In Project: waffle-jetty

Identifiers

asm-commons-5.0.1.jar

File Path: C:\Users\Jeremy\.m2\repository\org\ow2\asm\asm-commons\5.0.1\asm-commons-5.0.1.jar
MD5: 6b6ec238db815d6041bd1cea62eacc06
SHA1: 7b7147a390a93a14d2edfdcf3f7b0e87a0939c3e
Referenced In Project: waffle-jetty

Identifiers

asm-tree-5.0.1.jar

File Path: C:\Users\Jeremy\.m2\repository\org\ow2\asm\asm-tree\5.0.1\asm-tree-5.0.1.jar
MD5: 5924c798a4e14d0192f1a6f33f726c2c
SHA1: 1b1e6e9d869acd704056d0a4223071a511c619e6
Referenced In Project: waffle-jetty

Identifiers

asm-5.0.1.jar

File Path: C:\Users\Jeremy\.m2\repository\org\ow2\asm\asm\5.0.1\asm-5.0.1.jar
MD5: d6fa9169eb883ac82effd333eaffd4fc
SHA1: 2fd56467a018aafe6ec6a73ccba520be4a7e1565
Referenced In Project: waffle-jetty

Identifiers

jcl-over-slf4j-1.7.12.jar

Description: JCL 1.1.1 implemented over SLF4J

File Path: C:\Users\Jeremy\.m2\repository\org\slf4j\jcl-over-slf4j\1.7.12\jcl-over-slf4j-1.7.12.jar
MD5: 5989c932ad8fff557a90f6f9032e57f9
SHA1: adef7a9e1263298255fdb5cb107ff171d07c82f3
Referenced In Project: waffle-jetty

Identifiers

slf4j-api-1.7.12.jar

Description: The slf4j API

File Path: C:\Users\Jeremy\.m2\repository\org\slf4j\slf4j-api\1.7.12\slf4j-api-1.7.12.jar
MD5: 68910bf95dbcf90ce5859128f0f75d1e
SHA1: 8e20852d05222dc286bf1c71d78d0531e177c317
Referenced In Project: waffle-jetty

Identifiers



This report contains data retrieved from the National Vulnerability Database.