OFBiz › OFBiz - Commits

svn commit: r1754072 [2/2] - /ofbiz/trunk/tools/security/dependency-check/dependency-check-report.html

_‹ Previous Topic Next Topic _›

Classic

List

Threaded

1 message

jleroux@apache.org

svn commit: r1754072 [2/2] - /ofbiz/trunk/tools/security/dependency-check/dependency-check-report.html

Modified: ofbiz/trunk/tools/security/dependency-check/dependency-check-report.html
URL: http://svn.apache.org/viewvc/ofbiz/trunk/tools/security/dependency-check/dependency-check-report.html?rev=1754072&r1=1754071&r2=1754072&view=diff
==============================================================================
--- ofbiz/trunk/tools/security/dependency-check/dependency-check-report.html (original)
+++ ofbiz/trunk/tools/security/dependency-check/dependency-check-report.html Tue Jul 26 06:33:00 2016
@@ -1,879 +1,62631 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+
+
+
+
+<!DOCTYPE html>
<html>
-<head>
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
- <meta http-equiv="Content-Style-Type" content="text/css">
- <title>Dependency-Check Report</title>
- <meta name="Generator" content="Cocoa HTML Writer">
- <meta name="CocoaVersion" content="1404.47">
- <style type="text/css">
- p.p1 {margin: 0.0px 0.0px 9.0px 0.0px; line-height: 10.0px; font: 9.0px Arial; color: #888888; -webkit-text-stroke: #888888}
- p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000}
- p.p4 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; min-height: 15.0px}
- p.p5 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #0000ee; -webkit-text-stroke: #0000ee}
- p.p7 {margin: 0.0px 0.0px 13.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000}
- p.p9 {margin: 0.0px 0.0px 13.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #0000ee; -webkit-text-stroke: #0000ee}
- p.p10 {margin: 0.0px 0.0px 13.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; min-height: 15.0px}
- p.p11 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Courier; color: #000000; -webkit-text-stroke: #000000}
- p.p12 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff}
- li.li3 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000}
- li.li5 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #0000ee; -webkit-text-stroke: #0000ee}
- li.li13 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #0000ee}
- li.li14 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #0000ee; -webkit-text-stroke: #000000}
- span.s1 {font-kerning: none}
- span.s2 {text-decoration: underline ; font-kerning: none; color: #0000ee; -webkit-text-stroke: 0px #0000ee}
- span.s3 {-webkit-text-stroke: 0px #000000}
- span.s4 {font-kerning: none; color: #000000; -webkit-text-stroke: 0px #000000}
- span.s5 {text-decoration: underline ; font-kerning: none}
- span.s6 {font-kerning: none; background-color: #ffffff}
- span.s7 {color: #000000; background-color: #ffffff; -webkit-text-stroke: 0px #000000}
- span.s8 {font-kerning: none; color: #000000; background-color: #ffffff; -webkit-text-stroke: 0px #000000}
- span.s9 {background-color: #ffffff; -webkit-text-stroke: 0px #000000}
- span.s10 {font: 11.0px '.AppleSystemUIFont'; font-kerning: none; color: #555555; background-color: #eeeeee; -webkit-text-stroke: 0px #555555}
- span.s11 {text-decoration: underline ; font-kerning: none; background-color: #ffffff}
- span.s12 {text-decoration: underline ; font-kerning: none; color: #0000ee; background-color: #ffffff; -webkit-text-stroke: 0px #0000ee}
- span.s13 {text-decoration: underline ; font-kerning: none; color: #0000ee}
- span.s14 {font-kerning: none; background-color: #ffffff; -webkit-text-stroke: 0px #000000}
- span.s15 {color: #0000ee; background-color: #ffffff; -webkit-text-stroke: 0px #000000}
- span.s16 {text-decoration: underline ; font-kerning: none; -webkit-text-stroke: 0px #0000ee}
- span.s17 {font-kerning: none; color: #000000; background-color: #ffffff}
- span.s18 {font: 13.0px Arial; text-decoration: underline ; font-kerning: none; color: #0000ee; -webkit-text-stroke: 0px #0000ee}
- td.td1 {width: 89.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td2 {width: 234.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td3 {width: 210.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td4 {width: 51.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td5 {width: 38.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td6 {width: 71.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td7 {width: 58.0px; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td8 {width: 89.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td9 {width: 234.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td10 {width: 210.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td11 {width: 51.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td12 {width: 38.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td13 {width: 71.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- td.td14 {width: 58.0px; background-color: #f3f3f3; margin: 0.5px 0.5px 0.5px 0.5px; padding: 6.0px 6.0px 6.0px 6.0px}
- ul.ul1 {list-style-type: disc}
- </style>
-</head>
-<body>
-Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the userâs risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
-<h2 style="margin: 0.0px 0.0px 16.2px 0.0px; line-height: 23.0px; font: 20.0px Arial; color: #000000; -webkit-text-stroke: #000000">Project:Â OFBiz</h2>
-Scan Information (show all):
-<ul class="ul1">
- <li class="li3">dependency-check version: 1.3.6</li>
- <li class="li3">Report Generated On: May 31, 2016 at 19:43:00 IST</li>
- <li class="li3">Dependencies Scanned:Â 293</li>
- <li class="li3">Vulnerable Dependencies:Â 9</li>
- <li class="li3">Vulnerabilities Found:Â 19</li>
- <li class="li3">Vulnerabilities Suppressed:Â 112</li>
- <li class="li3">...</li>
-</ul>
- 
-Display:Â Showing Vulnerable Dependencies (click to show all)
- 
-<table cellspacing="0" cellpadding="0">
- <tbody>
- <tr>
- <td valign="middle" class="td1">
- Dependency
- </td>
- <td valign="middle" class="td2">
- CPE
- </td>
- <td valign="middle" class="td3">
- GAV
- </td>
- <td valign="middle" class="td4">
- Highest Severity
- </td>
- <td valign="middle" class="td5">
- CVE Count
- </td>
- <td valign="middle" class="td6">
- CPE Confidence
- </td>
- <td valign="middle" class="td7">
- Evidence Count
- </td>
- </tr>
- <tr>
- <td valign="top" class="td8">
- commons-beanutils-core-1.8.3.jar
- </td>
- <td valign="top" class="td9">
- cpe:/a:apache:commons_beanutils:1.8.3Â 
- </td>
- <td valign="top" class="td10">
- <a href="http://search.maven.org/remotecontent?filepath=commons-beanutils/commons-beanutils-core/1.8.3/commons-beanutils-core-1.8.3.jar">commons-beanutils:commons-beanutils-core:1.8.3</a>Â 
- </td>
- <td valign="top" class="td11">
- HighÂ 
- </td>
- <td valign="top" class="td12">
- 1
- </td>
- <td valign="top" class="td13">
- LOW
- </td>
- <td valign="top" class="td14">
- 21
- </td>
- </tr>
- <tr>
- <td valign="top" class="td8">
- jsp-api-2.3.jar
- </td>
- <td valign="top" class="td9">
- <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat:8.0.33</a>Â 
- </td>
- <td valign="top" class="td10">
- <a href="http://search.maven.org/remotecontent?filepath=org/apache/tomcat/tomcat-jsp-api/8.0.33/tomcat-jsp-api-8.0.33.jar">org.apache.tomcat:tomcat-jsp-api:8.0.33</a>Â 
- </td>
- <td valign="top" class="td11">
- HighÂ 
- </td>
- <td valign="top" class="td12">
- 4
- </td>
- <td valign="top" class="td13">
- LOW
- </td>
- <td valign="top" class="td14">
- 16
- </td>
- </tr>
- <tr>
- <td valign="top" class="td1">
- tomcat-8.0.33-jasper.jar
- </td>
- <td valign="top" class="td2">
- <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat:8.0.33</a>Â 
- </td>
- <td valign="top" class="td3">
- <a href="http://search.maven.org/remotecontent?filepath=org/apache/tomcat/tomcat-jasper/8.0.33/tomcat-jasper-8.0.33.jar">org.apache.tomcat:tomcat-jasper:8.0.33</a>Â 
- </td>
- <td valign="top" class="td4">
- HighÂ 
- </td>
- <td valign="top" class="td5">
- 4
- </td>
- <td valign="top" class="td6">
- LOW
- </td>
- <td valign="top" class="td7">
- 17
- </td>
- </tr>
- <tr>
- <td valign="top" class="td1">
- axis2-kernel-1.7.1.jar
- </td>
- <td valign="top" class="td2">
- cpe:/a:apache:axis2:1.7.1Â 
- </td>
- <td valign="top" class="td3">
- org.apache.axis2:axis2-kernel:1.7.1Â 
- </td>
- <td valign="top" class="td4">
- MediumÂ 
- </td>
- <td valign="top" class="td5">
- 2
- </td>
- <td valign="top" class="td6">
- LOW
- </td>
- <td valign="top" class="td7">
- 15
- </td>
- </tr>
- <tr>
- <td valign="top" class="td8">
- axis-1.4.jar
- </td>
- <td valign="top" class="td9">
- <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a>Â 
- </td>
- <td valign="top" class="td10">
- <a href="http://search.maven.org/remotecontent?filepath=axis/axis/1.4/axis-1.4.jar">axis:axis:1.4</a>Â 
- </td>
- <td valign="top" class="td11">
- MediumÂ 
- </td>
- <td valign="top" class="td12">
- 2
- </td>
- <td valign="top" class="td13">
- HIGHEST
- </td>
- <td valign="top" class="td14">
- 16
- </td>
- </tr>
- <tr>
- <td valign="top" class="td1">
- jaxrpc.jar
- </td>
- <td valign="top" class="td2">
- <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a>Â 
- </td>
- <td valign="top" class="td3">
- <a href="http://search.maven.org/remotecontent?filepath=axis/axis-jaxrpc/1.4/axis-jaxrpc-1.4.jar">axis:axis-jaxrpc:1.4</a>Â 
- </td>
- <td valign="top" class="td4">
- MediumÂ 
- </td>
- <td valign="top" class="td5">
- 2
- </td>
- <td valign="top" class="td6">
- HIGHEST
- </td>
- <td valign="top" class="td7">
- 12
- </td>
- </tr>
- <tr>
- <td valign="top" class="td1">
- saaj.jar
- </td>
- <td valign="top" class="td2">
- <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a>Â 
- </td>
- <td valign="top" class="td3">
- <a href="http://search.maven.org/remotecontent?filepath=axis/axis-saaj/1.4/axis-saaj-1.4.jar">axis:axis-saaj:1.4</a>Â 
- </td>
- <td valign="top" class="td4">
- MediumÂ 
- </td>
- <td valign="top" class="td5">
- 2
- </td>
- <td valign="top" class="td6">
- HIGHEST
- </td>
- <td valign="top" class="td7">
- 12
- </td>
- </tr>
- <tr>
- <td valign="top" class="td8">
- Tidy.jar
- </td>
- <td valign="top" class="td9">
- cpe:/a:eclipse:birt:-Â 
- </td>
- <td valign="top" class="td10">
- <a href="http://search.maven.org/remotecontent?filepath=org/eclipse/birt/runtime/3_7_1/Tidy/1/Tidy-1.jar">org.eclipse.birt.runtime.3_7_1:Tidy:1</a>Â 
- </td>
- <td valign="top" class="td11">
- MediumÂ 
- </td>
- <td valign="top" class="td12">
- 1
- </td>
- <td valign="top" class="td13">
- LOW
- </td>
- <td valign="top" class="td14">
- 11
- </td>
- </tr>
- <tr>
- <td valign="top" class="td1">
- viewservlets.jar
- </td>
- <td valign="top" class="td2">
- cpe:/a:eclipse:birt:-Â 
- </td>
- <td valign="top" class="td3">
- 
- </td>
- <td valign="top" class="td4">
- MediumÂ 
- </td>
- <td valign="top" class="td5">
- 1
- </td>
- <td valign="top" class="td6">
- LOW
- </td>
- <td valign="top" class="td7">
- 4
- </td>
- </tr>
- </tbody>
-</table>
-<h2 style="margin: 0.0px 0.0px 16.2px 0.0px; line-height: 23.0px; font: 20.0px Arial; color: #000000; -webkit-text-stroke: #000000">Dependencies</h2>
-<h3 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 17.0px; font: 15.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #cccccc">commons-beanutils-core-1.8.3.jar</h3>
-FileÂ Path:Â /Users/deepakdixit/sandbox/plain_ofbiz/framework/base/lib/commons/commons-beanutils-core-1.8.3.jar 
-MD5:Â 944f66e681239c8353e8497920f1e5d3 
-SHA1:Â 75812698e5e859f2cb587c622c4cdfcd61676426Â 
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Evidence</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Identifiers</h4>
-<ul class="ul1">
- <li class="li5">maven:Â <a href="http://search.maven.org/remotecontent?filepath=commons-beanutils/commons-beanutils-core/1.8.3/commons-beanutils-core-1.8.3.jar">commons-beanutils:commons-beanutils-core:1.8.3</a> Â Â Confidence:HIGHESTÂ </li>
- <li class="li3">cpe:Â cpe:/a:apache:commons_beanutils:1.8.3 Â Â Confidence:LOW Â Â suppressÂ </li>
-</ul>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Published Vulnerabilities</h4>
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0114">CVE-2014-0114</a>Â Â suppress
-Severity: High 
-CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 
-CWE: CWE-20 Improper Input ValidationÂ 
-Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.Â 
-<ul class="ul1">
- <li class="li5">BUGTRAQ - <a href="http://www.securityfocus.com/archive/1/archive/1/534161/100/0/threaded">20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities</a></li>
- <li class="li5">BUGTRAQ - <a href="http://www.securityfocus.com/archive/1/archive/1/535181/100/0/threaded">20150402 NEW : VMSA-2015-0003 VMware product updates address critical information disclosure issue in JRE</a></li>
- <li class="li5">CONFIRM - <a href="http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt">http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt</a></li>
- <li class="li5">CONFIRM - <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21676091">http://www-01.ibm.com/support/docview.wss?uid=swg21676091</a></li>
- <li class="li5">CONFIRM - <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21676303">http://www-01.ibm.com/support/docview.wss?uid=swg21676303</a></li>
- <li class="li5">CONFIRM - <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21676375">http://www-01.ibm.com/support/docview.wss?uid=swg21676375</a></li>
- <li class="li5">CONFIRM - <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21676931">http://www-01.ibm.com/support/docview.wss?uid=swg21676931</a></li>
- <li class="li5">CONFIRM - <a href="http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html">http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html">http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html">http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www.vmware.com/security/advisories/VMSA-2014-0012.html">http://www.vmware.com/security/advisories/VMSA-2014-0012.html</a></li>
- <li class="li5">CONFIRM - <a href="https://access.redhat.com/solutions/869353">https://access.redhat.com/solutions/869353</a></li>
- <li class="li5">CONFIRM - <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1091938">https://bugzilla.redhat.com/show_bug.cgi?id=1091938</a></li>
- <li class="li5">CONFIRM - <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1116665">https://bugzilla.redhat.com/show_bug.cgi?id=1116665</a></li>
- <li class="li5">CONFIRM - <a href="https://issues.apache.org/jira/browse/BEANUTILS-463">https://issues.apache.org/jira/browse/BEANUTILS-463</a></li>
- <li class="li3">DEBIAN - <a href="http://www.debian.org/security/2014/dsa-2940">DSA-2940</a></li>
- <li class="li5">FEDORA - <a href="http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html">FEDORA-2014-9380</a></li>
- <li class="li5">FULLDISC - <a href="http://seclists.org/fulldisclosure/2014/Dec/23">20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities</a></li>
- <li class="li5">FULLDISC - <a href="http://seclists.org/fulldisclosure/2015/Apr/5">20150402 NEW : VMSA-2015-0003 VMware product updates address critical information disclosure issue in JRE</a></li>
- <li class="li5">HP - <a href="http://marc.info/?l=bugtraq&m=141451023707502&w=2">HPSBST03160</a></li>
- <li class="li5">MISC - <a href="http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html">http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html</a></li>
- <li class="li5">MLIST - <a href="http://openwall.com/lists/oss-security/2014/06/15/10">[oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE</a></li>
- <li class="li5">MLIST - <a href="http://openwall.com/lists/oss-security/2014/07/08/1">[oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE</a></li>
-</ul>
- 
-Vulnerable Software & Versions:Â (show all)
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Acommons_beanutils%3A1.9.1">cpe:/a:apache:commons_beanutils:1.9.1</a> and all previous versions</li>
- <li class="li3">...</li>
-</ul>
- 
-<h3 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 17.0px; font: 15.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #cccccc">jsp-api-2.3.jar</h3>
-Description:Â JSP package 
-
-License:
-Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
-FileÂ Path:Â /Users/deepakdixit/sandbox/plain_ofbiz/framework/base/lib/j2eespecs/jsp-api-2.3.jar
-MD5:Â c88199ccae1b0e7ae339bd0c20b3ccde
-SHA1:Â 896e782956999c2632b3caa0caeb711720f28d7a
- 
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Evidence</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Identifiers</h4>
-<ul class="ul1">
- <li class="li13">cpe:Â <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat:8.0.33</a> Â Â Confidence:LOW Â Â suppressÂ </li>
- <li class="li5">maven:Â <a href="http://search.maven.org/remotecontent?filepath=org/apache/tomcat/tomcat-jsp-api/8.0.33/tomcat-jsp-api-8.0.33.jar">org.apache.tomcat:tomcat-jsp-api:8.0.33</a> Â Â Confidence:HIGHESTÂ </li>
-</ul>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Published Vulnerabilities</h4>
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2185">CVE-2013-2185</a>Â Â suppress
-Severity: High 
-CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 
-CWE: CWE-20 Improper Input ValidationÂ 
-** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.Â 
-<ul class="ul1">
- <li class="li5">MLIST - <a href="http://www.openwall.com/lists/oss-security/2013/09/05/4">[oss-security] 20130905 Re: CVE-2013-2185 / Tomcat</a></li>
- <li class="li5">MLIST - <a href="http://openwall.com/lists/oss-security/2014/10/24/12">[oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-1193.html">RHSA-2013:1193</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-1194.html">RHSA-2013:1194</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-1265.html">RHSA-2013:1265</a></li>
-</ul>
- 
-Vulnerable Software & Versions:Â (show all)
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
- <li class="li3">...</li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2696">CVE-2009-2696</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 
-CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Â 
-Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.Â 
-<ul class="ul1">
- <li class="li5">CONFIRM - <a href="https://bugzilla.redhat.com/show_bug.cgi?id=616717">https://bugzilla.redhat.com/show_bug.cgi?id=616717</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2010-0580.html">RHSA-2010:0580</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2010/1986">ADV-2010-1986</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5461">CVE-2007-5461</a>Â Â suppress
-Severity: Low 
-CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) 
-CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Â 
-Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.Â 
-<ul class="ul1">
- <li class="li5">APPLE - <a href="http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html">APPLE-SA-2008-06-30</a></li>
- <li class="li5">APPLE - <a href="http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html">APPLE-SA-2008-10-09</a></li>
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/26070">26070</a></li>
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/31681">31681</a></li>
- <li class="li5">BUGTRAQ - <a href="http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded">20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components</a></li>
- <li class="li5">CONFIRM - <a href="http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html">http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html</a></li>
- <li class="li5">CONFIRM - <a href="http://support.apple.com/kb/HT2163">http://support.apple.com/kb/HT2163</a></li>
- <li class="li5">CONFIRM - <a href="http://support.apple.com/kb/HT3216">http://support.apple.com/kb/HT3216</a></li>
- <li class="li5">CONFIRM - <a href="http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm">http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm</a></li>
- <li class="li5">CONFIRM - <a href="http://tomcat.apache.org/security-4.html">http://tomcat.apache.org/security-4.html</a></li>
- <li class="li5">CONFIRM - <a href="http://tomcat.apache.org/security-5.html">http://tomcat.apache.org/security-5.html</a></li>
- <li class="li5">CONFIRM - <a href="http://tomcat.apache.org/security-6.html">http://tomcat.apache.org/security-6.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www-1.ibm.com/support/docview.wss?uid=swg21286112">http://www-1.ibm.com/support/docview.wss?uid=swg21286112</a></li>
- <li class="li5">CONFIRM - <a href="http://www.vmware.com/security/advisories/VMSA-2008-0010.html">http://www.vmware.com/security/advisories/VMSA-2008-0010.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www.vmware.com/security/advisories/VMSA-2009-0016.html">http://www.vmware.com/security/advisories/VMSA-2009-0016.html</a></li>
- <li class="li3">DEBIAN - <a href="http://www.debian.org/security/2008/dsa-1447">DSA-1447</a></li>
- <li class="li3">DEBIAN - <a href="http://www.debian.org/security/2008/dsa-1453">DSA-1453</a></li>
- <li class="li5">FEDORA - <a href="https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html">FEDORA-2007-3456</a></li>
- <li class="li5">FULLDISC - <a href="http://marc.info/?l=full-disclosure&m=119239530508382">20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay</a></li>
- <li class="li5">GENTOO - <a href="http://security.gentoo.org/glsa/glsa-200804-10.xml">GLSA-200804-10</a></li>
- <li class="li5">HP - <a href="http://marc.info/?l=bugtraq&m=139344343412337&w=2">HPSBST02955</a></li>
- <li class="li13">MANDRIVA - <a href="http://www.mandriva.com/security/advisories?name=MDKSA-2007:241">MDKSA-2007:241</a></li>
- <li class="li13">MANDRIVA - <a href="http://www.mandriva.com/security/advisories?name=MDVSA-2009:136">MDVSA-2009:136</a></li>
- <li class="li3">MILW0RM - <a href="http://www.milw0rm.com/exploits/4530">4530</a></li>
- <li class="li5">MISC - <a href="http://issues.apache.org/jira/browse/GERONIMO-3549">http://issues.apache.org/jira/browse/GERONIMO-3549</a></li>
- <li class="li5">MLIST - <a href="http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@...%3E">[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0042.html">RHSA-2008:0042</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0195.html">RHSA-2008:0195</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0261.html">RHSA-2008:0261</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2008-0630.html">RHSA-2008:0630</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0862.html">RHSA-2008:0862</a></li>
- <li class="li3">SECTRACK - <a href="http://www.securitytracker.com/id?1018864">1018864</a></li>
- <li class="li3">SUNALERT - <a href="http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1">239312</a></li>
- <li class="li5">SUSE - <a href="http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html">SUSE-SR:2008:005</a></li>
- <li class="li5">SUSE - <a href="http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html">SUSE-SR:2009:004</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2007/3622">ADV-2007-3622</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2007/3671">ADV-2007-3671</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2007/3674">ADV-2007-3674</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/1856/references">ADV-2008-1856</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/1979/references">ADV-2008-1979</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/1981/references">ADV-2008-1981</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/2780">ADV-2008-2780</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/2823">ADV-2008-2823</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2009/3316">ADV-2009-3316</a></li>
- <li class="li5">XF - <a href="http://xforce.iss.net/xforce/xfdb/37243">apache-tomcat-webdav-dir-traversal(37243)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0493">CVE-2002-0493</a>Â Â suppress
-Severity: High 
-CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)Â 
-Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.Â 
-<ul class="ul1">
- <li class="li5">BUGTRAQ - <a href="http://marc.theaimsgroup.com/?l=bugtraq&m=101709002410365&w=2">20020325 re: Tomcat Security Exposure</a></li>
- <li class="li5">MISC - <a href="http://www.apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail@...%3E">http://www.apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail@...%3E</a></li>
- <li class="li5">XF - <a href="http://www.iss.net/security_center/static/9863.php">tomcat-xml-bypass-restrictions(9863)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
-</ul>
- 
-<h3 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 17.0px; font: 15.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #cccccc">tomcat-8.0.33-jasper.jar</h3>
-Description:Â Tomcats JSP Parser 
-
-License:
-Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
-FileÂ Path:Â /Users/deepakdixit/sandbox/plain_ofbiz/framework/catalina/lib/tomcat-8.0.33-jasper.jar
-MD5:Â 77fb07272f972db78bd54712ed82e961
-SHA1:Â 30525359ecc82c313a71e056adc917f952580f5e
- 
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Evidence</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Related Dependencies</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Identifiers</h4>
-<ul class="ul1">
- <li class="li13">cpe:Â <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat:8.0.33</a> Â Â Confidence:LOW Â Â suppressÂ </li>
- <li class="li5">maven:Â <a href="http://search.maven.org/remotecontent?filepath=org/apache/tomcat/tomcat-jasper/8.0.33/tomcat-jasper-8.0.33.jar">org.apache.tomcat:tomcat-jasper:8.0.33</a> Â Â Confidence:HIGHESTÂ </li>
-</ul>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Published Vulnerabilities</h4>
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2185">CVE-2013-2185</a>Â Â suppress
-Severity: High 
-CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 
-CWE: CWE-20 Improper Input ValidationÂ 
-** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.Â 
-<ul class="ul1">
- <li class="li5">MLIST - <a href="http://www.openwall.com/lists/oss-security/2013/09/05/4">[oss-security] 20130905 Re: CVE-2013-2185 / Tomcat</a></li>
- <li class="li5">MLIST - <a href="http://openwall.com/lists/oss-security/2014/10/24/12">[oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-1193.html">RHSA-2013:1193</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-1194.html">RHSA-2013:1194</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-1265.html">RHSA-2013:1265</a></li>
-</ul>
- 
-Vulnerable Software & Versions:Â (show all)
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
- <li class="li3">...</li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2696">CVE-2009-2696</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 
-CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Â 
-Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.Â 
-<ul class="ul1">
- <li class="li5">CONFIRM - <a href="https://bugzilla.redhat.com/show_bug.cgi?id=616717">https://bugzilla.redhat.com/show_bug.cgi?id=616717</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2010-0580.html">RHSA-2010:0580</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2010/1986">ADV-2010-1986</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5461">CVE-2007-5461</a>Â Â suppress
-Severity: Low 
-CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) 
-CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Â 
-Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.Â 
-<ul class="ul1">
- <li class="li5">APPLE - <a href="http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html">APPLE-SA-2008-06-30</a></li>
- <li class="li5">APPLE - <a href="http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html">APPLE-SA-2008-10-09</a></li>
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/26070">26070</a></li>
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/31681">31681</a></li>
- <li class="li5">BUGTRAQ - <a href="http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded">20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components</a></li>
- <li class="li5">CONFIRM - <a href="http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html">http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html</a></li>
- <li class="li5">CONFIRM - <a href="http://support.apple.com/kb/HT2163">http://support.apple.com/kb/HT2163</a></li>
- <li class="li5">CONFIRM - <a href="http://support.apple.com/kb/HT3216">http://support.apple.com/kb/HT3216</a></li>
- <li class="li5">CONFIRM - <a href="http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm">http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm</a></li>
- <li class="li5">CONFIRM - <a href="http://tomcat.apache.org/security-4.html">http://tomcat.apache.org/security-4.html</a></li>
- <li class="li5">CONFIRM - <a href="http://tomcat.apache.org/security-5.html">http://tomcat.apache.org/security-5.html</a></li>
- <li class="li5">CONFIRM - <a href="http://tomcat.apache.org/security-6.html">http://tomcat.apache.org/security-6.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www-1.ibm.com/support/docview.wss?uid=swg21286112">http://www-1.ibm.com/support/docview.wss?uid=swg21286112</a></li>
- <li class="li5">CONFIRM - <a href="http://www.vmware.com/security/advisories/VMSA-2008-0010.html">http://www.vmware.com/security/advisories/VMSA-2008-0010.html</a></li>
- <li class="li5">CONFIRM - <a href="http://www.vmware.com/security/advisories/VMSA-2009-0016.html">http://www.vmware.com/security/advisories/VMSA-2009-0016.html</a></li>
- <li class="li3">DEBIAN - <a href="http://www.debian.org/security/2008/dsa-1447">DSA-1447</a></li>
- <li class="li3">DEBIAN - <a href="http://www.debian.org/security/2008/dsa-1453">DSA-1453</a></li>
- <li class="li5">FEDORA - <a href="https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html">FEDORA-2007-3456</a></li>
- <li class="li5">FULLDISC - <a href="http://marc.info/?l=full-disclosure&m=119239530508382">20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay</a></li>
- <li class="li5">GENTOO - <a href="http://security.gentoo.org/glsa/glsa-200804-10.xml">GLSA-200804-10</a></li>
- <li class="li5">HP - <a href="http://marc.info/?l=bugtraq&m=139344343412337&w=2">HPSBST02955</a></li>
- <li class="li13">MANDRIVA - <a href="http://www.mandriva.com/security/advisories?name=MDKSA-2007:241">MDKSA-2007:241</a></li>
- <li class="li13">MANDRIVA - <a href="http://www.mandriva.com/security/advisories?name=MDVSA-2009:136">MDVSA-2009:136</a></li>
- <li class="li3">MILW0RM - <a href="http://www.milw0rm.com/exploits/4530">4530</a></li>
- <li class="li5">MISC - <a href="http://issues.apache.org/jira/browse/GERONIMO-3549">http://issues.apache.org/jira/browse/GERONIMO-3549</a></li>
- <li class="li5">MLIST - <a href="http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@...%3E">[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0042.html">RHSA-2008:0042</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0195.html">RHSA-2008:0195</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0261.html">RHSA-2008:0261</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2008-0630.html">RHSA-2008:0630</a></li>
- <li class="li5">REDHAT - <a href="http://www.redhat.com/support/errata/RHSA-2008-0862.html">RHSA-2008:0862</a></li>
- <li class="li3">SECTRACK - <a href="http://www.securitytracker.com/id?1018864">1018864</a></li>
- <li class="li3">SUNALERT - <a href="http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1">239312</a></li>
- <li class="li5">SUSE - <a href="http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html">SUSE-SR:2008:005</a></li>
- <li class="li5">SUSE - <a href="http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html">SUSE-SR:2009:004</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2007/3622">ADV-2007-3622</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2007/3671">ADV-2007-3671</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2007/3674">ADV-2007-3674</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/1856/references">ADV-2008-1856</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/1979/references">ADV-2008-1979</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/1981/references">ADV-2008-1981</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/2780">ADV-2008-2780</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2008/2823">ADV-2008-2823</a></li>
- <li class="li5">VUPEN - <a href="http://www.vupen.com/english/advisories/2009/3316">ADV-2009-3316</a></li>
- <li class="li5">XF - <a href="http://xforce.iss.net/xforce/xfdb/37243">apache-tomcat-webdav-dir-traversal(37243)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0493">CVE-2002-0493</a>Â Â suppress
-Severity: High 
-CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)Â 
-Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.Â 
-<ul class="ul1">
- <li class="li5">BUGTRAQ - <a href="http://marc.theaimsgroup.com/?l=bugtraq&m=101709002410365&w=2">20020325 re: Tomcat Security Exposure</a></li>
- <li class="li5">MISC - <a href="http://www.apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail@...%3E">http://www.apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail@...%3E</a></li>
- <li class="li5">XF - <a href="http://www.iss.net/security_center/static/9863.php">tomcat-xml-bypass-restrictions(9863)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Atomcat">cpe:/a:apache:tomcat</a>Â </li>
-</ul>
- 
-<h3 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 17.0px; font: 15.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #cccccc">axis2-kernel-1.7.1.jar</h3>
-Description:Â Core Parts of Axis2. This includes Axis2 engine, Client API, Addressing support, etc., 
-
-FileÂ Path:Â /Users/deepakdixit/sandbox/plain_ofbiz/framework/service/lib/axis2-kernel-1.7.1.jar 
-MD5:Â f3b93056eebaf4c7f71c84def4f486e9 
-SHA1:Â b60e8f9dfc753a9d3aff02dbaee58a560afffbc3Â 
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Evidence</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Related Dependencies</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Identifiers</h4>
-<ul class="ul1">
- <li class="li3">cpe:Â cpe:/a:apache:axis2:1.7.1 Â Â Confidence:LOW Â Â suppressÂ </li>
- <li class="li3">maven:Â org.apache.axis2:axis2-kernel:1.7.1 Â Â Confidence:HIGHÂ </li>
-</ul>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Published Vulnerabilities</h4>
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5351">CVE-2012-5351</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 
-CWE: CWE-287 Improper AuthenticationÂ 
-Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.Â 
-<ul class="ul1">
- <li class="li5">MISC - <a href="http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf">http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf</a></li>
- <li class="li5">XF - <a href="http://xforce.iss.net/xforce/xfdb/79487">apache-axis2-saml-sec-bypass(79487)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis2%3A-">cpe:/a:apache:axis2:-</a>Â </li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4418">CVE-2012-4418</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 
-CWE: CWE-287 Improper AuthenticationÂ 
-Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."Â 
-<ul class="ul1">
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/55508">55508</a></li>
- <li class="li5">CONFIRM - <a href="https://bugzilla.redhat.com/show_bug.cgi?id=856755">https://bugzilla.redhat.com/show_bug.cgi?id=856755</a></li>
- <li class="li5">MISC - <a href="http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf">http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf</a></li>
- <li class="li5">MLIST - <a href="http://www.openwall.com/lists/oss-security/2012/09/12/1">[oss-security] 20120912 CVE Request: Apache Axis2 XML Signature Wrapping Attack</a></li>
- <li class="li5">MLIST - <a href="http://www.openwall.com/lists/oss-security/2012/09/13/1">[oss-security] 20120912 Re: CVE Request: Apache Axis2 XML Signature Wrapping Attack</a></li>
-</ul>
- 
-Vulnerable Software & Versions:
-<ul class="ul1">
- <li class="li5"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis2%3A-">cpe:/a:apache:axis2:-</a>Â </li>
-</ul>
- 
-<h3 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 17.0px; font: 15.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #cccccc">axis-1.4.jar</h3>
-Description:Â An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C. 
-
-License:
-The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
-FileÂ Path:Â /Users/deepakdixit/sandbox/plain_ofbiz/specialpurpose/birt/lib/axis-1.4.jar
-MD5:Â 03dcfdd88502505cc5a805a128bfdd8d
-SHA1:Â 94a9ce681a42d0352b3ad22659f67835e560d107
- 
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Evidence</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Related Dependencies</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Identifiers</h4>
-<ul class="ul1">
- <li class="li3">maven:Â <a href="http://search.maven.org/remotecontent?filepath=axis/axis/1.4/axis-1.4.jar">axis:axis:1.4</a> Â Â Confidence:HIGHESTÂ </li>
- <li class="li3">cpe:Â <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a> Â Â Confidence:HIGHEST Â Â suppressÂ </li>
- <li class="li3">maven:Â <a href="http://search.maven.org/remotecontent?filepath=org/apache/axis/axis/1.4/axis-1.4.jar">org.apache.axis:axis:1.4</a> Â Â Confidence:HIGHESTÂ </li>
-</ul>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Published Vulnerabilities</h4>
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596">CVE-2014-3596</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)Â 
-The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.Â 
-<ul class="ul1">
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/69295">69295</a></li>
- <li class="li5">MISC - <a href="https://issues.apache.org/jira/browse/AXIS-2905">https://issues.apache.org/jira/browse/AXIS-2905</a></li>
- <li class="li5">MLIST - <a href="http://www.openwall.com/lists/oss-security/2014/08/20/2">[oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2014-1193.html">RHSA-2014:1193</a></li>
- <li class="li3">SECTRACK - <a href="http://www.securitytracker.com/id/1030745">1030745</a></li>
- <li class="li5">XF - <a href="http://xforce.iss.net/xforce/xfdb/95377">apache-axis-cve20143596-spoofing(95377)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:Â (show all)
-<ul class="ul1">
- <li class="li3"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a> and all previous versions</li>
- <li class="li3">...</li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5784">CVE-2012-5784</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 
-CWE: CWE-20 Improper Input ValidationÂ 
-Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Â 
-<ul class="ul1">
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/56408">56408</a></li>
- <li class="li5">MISC - <a href="http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf">http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-0269.html">RHSA-2013:0269</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2013-0683.html">RHSA-2013:0683</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2014-0037.html">RHSA-2014:0037</a></li>
- <li class="li5">XF - <a href="http://xforce.iss.net/xforce/xfdb/79829">apache-axis-ssl-spoofing(79829)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:Â (show all)
-<ul class="ul1">
- <li class="li3"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a> and all previous versions</li>
- <li class="li3">...</li>
-</ul>
- 
-<h3 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 17.0px; font: 15.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #cccccc">jaxrpc.jar</h3>
-FileÂ Path:Â /Users/deepakdixit/sandbox/plain_ofbiz/specialpurpose/birt/lib/jaxrpc.jar 
-MD5:Â b4592e5eccfeeeae87cfadef0ca66c66 
-SHA1:Â b393f1f0c0d95b68c86d0b1ab2e687bb71f3c075Â 
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Evidence</h4>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Identifiers</h4>
-<ul class="ul1">
- <li class="li3">maven:Â <a href="http://search.maven.org/remotecontent?filepath=axis/axis-jaxrpc/1.4/axis-jaxrpc-1.4.jar">axis:axis-jaxrpc:1.4</a> Â Â Confidence:HIGHESTÂ </li>
- <li class="li3">cpe:Â <a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a> Â Â Confidence:HIGHEST Â Â suppressÂ </li>
- <li class="li13">maven:Â <a href="http://search.maven.org/remotecontent?filepath=org/apache/axis/axis-jaxrpc/1.4/axis-jaxrpc-1.4.jar">org.apache.axis:axis-jaxrpc:1.4</a> Â Â Confidence:HIGHESTÂ </li>
-</ul>
-<h4 style="margin: 0.0px 20.0px 0.0px 0.0px; line-height: 15.0px; font: 13.0px Arial; color: #000000; -webkit-text-stroke: #000000; background-color: #ffffff">Published Vulnerabilities</h4>
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596">CVE-2014-3596</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)Â 
-The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.Â 
-<ul class="ul1">
- <li class="li3">BID - <a href="http://www.securityfocus.com/bid/69295">69295</a></li>
- <li class="li5">MISC - <a href="https://issues.apache.org/jira/browse/AXIS-2905">https://issues.apache.org/jira/browse/AXIS-2905</a></li>
- <li class="li5">MLIST - <a href="http://www.openwall.com/lists/oss-security/2014/08/20/2">[oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack</a></li>
- <li class="li5">REDHAT - <a href="http://rhn.redhat.com/errata/RHSA-2014-1193.html">RHSA-2014:1193</a></li>
- <li class="li3">SECTRACK - <a href="http://www.securitytracker.com/id/1030745">1030745</a></li>
- <li class="li5">XF - <a href="http://xforce.iss.net/xforce/xfdb/95377">apache-axis-cve20143596-spoofing(95377)</a></li>
-</ul>
- 
-Vulnerable Software & Versions:Â (show all)
-<ul class="ul1">
- <li class="li3"><a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Aapache%3Aaxis%3A1.4">cpe:/a:apache:axis:1.4</a> and all previous versions</li>
- <li class="li3">...</li>
-</ul>
- 
-<a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5784">CVE-2012-5784</a>Â Â suppress
-Severity: Medium 
-CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 
-CWE: CWE-20 Improper Input ValidationÂ 

[... 62760 lines stripped ...]