Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Description:
JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).
License:
Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.htmlFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\activation-1.1.jar
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\annogen-0.1.0.jar
MD5: ff275c3491ac6715ad9f6c22a9660503
SHA1: a8de34ea7aa93765d24dc16ec9c61af5160bb899
Description: Annotation the FindBugs tool supports
License:
GNU Lesser Public License: http://www.gnu.org/licenses/lgpl.htmlFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\annotations-3.0.1u2.jar
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ant-1.9.7.jar
MD5: a14502c25ee6bc76c4614315845b29e9
SHA1: 3b2a10512ee6537d3852c9b693a0284dcab5de68
Description: AOP Alliance
License:
Public DomainFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\aopalliance-1.0.jar
Description: The runtime needed to execute a program using AspectJ
License:
Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.htmlFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\aspectjrt-1.6.5.jar
Description: The AspectJ weaver introduces advices to java classes
License:
Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.htmlFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\aspectjweaver-1.6.5.jar
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\binutils\configure
MD5: 87ef7e524d4c3190c297ce64df0e600e
SHA1: ed33427ceee41faa5e69fb89452cd69318e3723a
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\binutils\configure.ac
MD5: 1982a659f09482b4eabbf19a000822fa
SHA1: 4dd69b029c1e0ebd8a087f0ef14742e83708b79a
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\ghostscript\configure.ac
MD5: a7e8bdc5c0dab93d042e822130b8cfc9
SHA1: 94d7acda832dc53ab91892dcdd4b1ac9fc191e75
Severity:
High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors
icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly other versions, allows remote attackers to cause a denial of service (ps2pdf crash) and possibly execute arbitrary code via a crafted Postscript file.
Vulnerable Software & Versions:
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\readable-code\configure
MD5: e4b0986a605c8d223bcd8cbf036caae8
SHA1: cd18db2a682ef6c3deeeab099d2036e405a1f07c
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\readable-code\configure.ac
MD5: d130e2fa32a516b4898b3de12b1b42bc
SHA1: 5dba846da57603462614e4b6801cc82655519023
Description: The Axiom API
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axiom-api-1.2.7.jar
Description: The Axiom DOM implementation.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axiom-dom-1.2.7.jar
Description: The Axiom default implementation.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axiom-impl-1.2.7.jar
Description:
An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axis-1.4.jar
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-20 Improper Input Validation
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions: (show all)
Description: Core Parts of Axis 2.0. This includes Axis 2.0 engine, Client API, Addressing support, etc.,
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axis2-kernel-1.4.1.jar
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-20 Improper Input Validation
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-255 Credentials Management
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
Vulnerable Software & Versions: (show all)
Description: Dawid Kurzyniec's backport of JSR 166
License:
Public Domain: http://creativecommons.org/licenses/publicdomainFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\backport-util-concurrent-3.1.jar
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\bootable-0.1.0.jar
MD5: 22d05d41c7d7174a1166802d5cb34a01
SHA1: f8801c5780e56c6b7e86b3a729b0f4003225dae7
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\bootable-0.1.0.jar\lib\lib-0.1.0.jar
MD5: 877e0eb39e3c985e2c1d553bb6dad934
SHA1: 13af17492135898d8ebced6cfe7aa3b9914ddeaa
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\3rdparty\ffmpeg\ffmpeg_version.cmake
MD5: 47c336385aec534dee9a316f3ac04773
SHA1: 81feb6f931f727482b71b2e34f325387f46ad09b
Severity:
High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors
Integer underflow in the asfrtp_parse_packet function in libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers to execute arbitrary code via a crafted ASF packet.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors
Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.
Vulnerable Software & Versions: (show all)
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\cl2cpp.cmake
MD5: 39ac6f35af7d4dd3ac3d75c06afe0613
SHA1: 1113347fe96d7d514c9f0bf711b96b352808dd0a
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\copyAndroidLibs.cmake
MD5: 6cea8a766548a7db3855ccec5627271d
SHA1: 8c9e2de7b35767238467548af3e05166e39edf4f
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA.cmake
MD5: 082b257f892af1049627ab591e88ad5e
SHA1: 30b72858802f64c3e5331b6ec70e59dbad58673a
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA\make2cmake.cmake
MD5: 5a3c246f2fc21437ba265fa979b160d8
SHA1: 43d5d598c58f5f140d162975a92d2730806cce3f
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA\parse_cubin.cmake
MD5: 5e5fb166c6c93c04621796f04189d0d7
SHA1: 3ecad79fcfe7c5d88a1535d1030026e1fcb2fce0
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA\run_nvcc.cmake
MD5: d6160a6dcaaec3e526bc34cfcea2ee23
SHA1: 0349f1a43fbd380b0c7b578ae3242a7cb6d43cae
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVCompilerOptions.cmake
MD5: b40df1c984b511841c40d05a907d433d
SHA1: 30589febdc497eb330eb932a6a1f10197b362fb4
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVConfig.cmake
MD5: f1f68ff13813a495470c6e73cc9b892a
SHA1: ad85337bb1ccac4a1261f6dda6ad1efcbce8b19d
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVCRTLinkage.cmake
MD5: 7f8dcbf9848068f53e352679c0859cd5
SHA1: 25bcb6542245cf8497b467a1363fdf6adeaa67e2
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectAndroidSDK.cmake
MD5: bd17bbe3d290b31f39ca4f7876baf725
SHA1: c72e36dd3a7e6b933595c0724a2ce47a9d0fc45e
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectApacheAnt.cmake
MD5: c94b15ca35aec95bb1bdc6a8eec5ede1
SHA1: 33e018cfb004b30a5bd9c58e613172c36d74af41
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectCStripes.cmake
MD5: b7be59d929d4daf4ff6e367cd413f795
SHA1: a9e20a51d1d50603da768ab3fd7b6fdc03257370
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectCUDA.cmake
MD5: e8acb70a35eafaf93531804da5b3e827
SHA1: ca9162fe9849f5ebe84e14fc0ac6ea2a864da811
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectCXXCompiler.cmake
MD5: d57d4cab100ce6d86a2abcf43895759d
SHA1: 1ed30817b5b2dd7c02d832ba95654ae120175715
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectDirectX.cmake
MD5: 30652d429f0a8562c7e8856517c4514d
SHA1: ce1afeafae26f37681b1a5ac698723e9d098dcff
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectOpenCL.cmake
MD5: 7420a52a371cea66b93e2067c70b7f38
SHA1: 7d318b5bf007a532d3adc8f1c6978fdb365fa2c5
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectPython.cmake
MD5: 5be7cd9ed88517f1017de27b8eb3228c
SHA1: 9bc4060369dbf9e7ece57639db81488115c84e13
Severity:
Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-190 Integer Overflow or Wraparound
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation
The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-693 Protection Mechanism Failure
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CWE: CWE-189 Numeric Errors
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-310 Cryptographic Issues
Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.
Vulnerable Software & Versions: (show all)
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectTBB.cmake
MD5: 35189457dc179a836ad4484994d5976d
SHA1: 40ea5f223fe4deb3713b3f3d2e16e6e1b6772617
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectVTK.cmake
MD5: c134da83c26ab7a2da167d844c79ad03
SHA1: 47fe39d954f02e6ece66d6b30294798c2d1057bf
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVExtraTargets.cmake
MD5: 300f1984f05136a2550662b4bba28484
SHA1: f9df6c52285f609bc449e0d264cec3ba4d33495c
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindIntelPerCSDK.cmake
MD5: 4a8839ddf7a69626978b6f51d8148ba8
SHA1: a0c46db81c0ccadc5c0d4d8d1b28c506836e3dc5
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindIPP.cmake
MD5: 1b0e6265a662426ed5ee3a8eae3571f1
SHA1: 1bffb60918a63d6865165cb47e53d08971bfdb3e
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindIPPAsync.cmake
MD5: 9053f0d6f31a969eaa1fc6ae03d72b45
SHA1: 0487f605adcfaabf4c4d2898691c3c453c6cd98d
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLATEX.cmake
MD5: c048924d7b99ee46b0ad194b0e9236a2
SHA1: 59493c4b35f9772e5f46b8195804b73bc0b8cd68
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsGrfmt.cmake
MD5: 471c89912ae29f34ce3d8951bfaba775
SHA1: e41b7bd06b878254fba925fd6d5d97e8f7e4abdd
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsGUI.cmake
MD5: c744b1958188a1418eab4eb8f295631a
SHA1: e4791e1c486531692bc0aa07ee144276ff957b17
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsPerf.cmake
MD5: 10f99115bf875881b2802eabd746a628
SHA1: 1ebfda9512e60f2f75ec491b17c3b2bf3649980d
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsVideo.cmake
MD5: 4d81f6af4a31bd51dee812e87617219d
SHA1: 979689596b9e86b846f514d87e56bf87895c1279
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindMatlab.cmake
MD5: 9f8df03241c51e2003d1bcfe9f99949d
SHA1: 895e96702c15ae75ed3a9904762104e8e67c9349
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindOpenEXR.cmake
MD5: c596e3648c5aed16362c90abf1a69885
SHA1: 91cd4c5d5cd98d1990f23dfd8a52de7525fe2636
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindOpenNI.cmake
MD5: 98bcd2f11e0793e231abd8a3ffb32faa
SHA1: b7274cea06a5973a42553d6b4b9ff428785f6d48
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindOpenNI2.cmake
MD5: 1409780229828db7219727ad64db1f6e
SHA1: daa97eb9f5072aa4bc951eda2a921fc35d2eac2b
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindWebP.cmake
MD5: 02b64eac70bf1852a0be5fda17c92e11
SHA1: 949fb1bd9eeebf9b55eeaa3a8f4d95a450c47b13
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindXimea.cmake
MD5: b65b6afa478b612f1ab8f4486b3ba791
SHA1: f8cf6b2baa915d9488062a317f2c6e473ad96ef1
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenABI.cmake
MD5: dab62ee8b994fba211e1877c88dcb7ae
SHA1: d01fed523caff4a3be0c0b0062e7a192f0b3e592
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenAndroidMK.cmake
MD5: 9523098110ae460e82b9d5e44ad4c7ad
SHA1: 63024b62e8b39fa23658b8ec10830d94b72587d9
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenConfig.cmake
MD5: a2ab87729d247b60a7c4aaedd9a9389d
SHA1: 0bdf47a9c04ac44f62d8cf7806640bf8be9825b2
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenHeaders.cmake
MD5: 5a7d0877b8f16a4f5c62757a0051dcc5
SHA1: d7cfe5e707b00ec2e79d6aef77b339ea3c7b2f17
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenInfoPlist.cmake
MD5: ce0875d872f99c9ef28d52a8f59a85f2
SHA1: 313376669a28af75d25ab8b735132550a4f3052e
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenPkgconfig.cmake
MD5: 61f497e15c639f7231c0657cf51202fd
SHA1: d2e5ea3b8a68485bbac4a205c7a68217ed66e779
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVMinDepVersions.cmake
MD5: d1dde2680e36cc1889856ca3f1502d2a
SHA1: 139df4b6c44a3454d180e608dcac8a6489c68a18
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVModule.cmake
MD5: 5f5dcd91004c42bdf9f42babcc2d2d56
SHA1: ff2a67f9ac07ca9e24060423f17ca6c9b9249a5b
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVPackaging.cmake
MD5: 523b5531ee9126224ba0573830643176
SHA1: 96797a22ee5edac0629dc40cbe823f492d531d69
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVPCHSupport.cmake
MD5: 9d50a0c038a112a9f3b4312930244fd0
SHA1: ed94777aaa7d9f2b58411a3ce2ec38863473f9f7
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVUtils.cmake
MD5: bf033cbe5749eb6eb060c3ac076a33f8
SHA1: 97c14247374bce9ff0595063c2fe0ff96081b0fb
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVVersion.cmake
MD5: 9afc0036841d17576b57b714120fc629
SHA1: aff16bf50579427fd3e55d407b0d3ac2f72ef18e
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\CMakeLists.txt
MD5: b1b39612f8273876aeed9039f3aa7254
SHA1: 69a4df896246065fc9a16ff259d415c833b9c95a
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\zlib\CMakeLists.txt
MD5: 6452c3208faaaafdb71447a509a9c78a
SHA1: 7b4d80f4fe6bf3086fa3f6c19a8fc8179e172721
Description:
Commons CLI provides a simple API for presenting, processing and validating a command line interface.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-cli-1.2.jar
Description: The codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-codec-1.2.jar
MD5: 2617b220009f952bb9542af167d040cf
SHA1: 397f4731a9f9b6eb1907e224911c77ea3aa27a8b
Description: Types that extend and augment the Java Collections Framework.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-collections-3.2.2.jar
Description:
Apache Commons Compress software defines an API for working with
compression and archive formats. These include: bzip2, gzip, pack200,
lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio,
jar, tar, zip, dump, 7z, arj.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-compress-1.12.jar
Description:
The FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-fileupload-1.2.1.jar
Severity:
High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Vulnerable Software & Versions: (show all)