Dependency-Check Report

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
ant-1.10.8.jar	cpe:2.3:a:apache:ant:1.10.8:::::::*	pkg:maven/org.apache.ant/ant@1.10.8	HIGH	4	Highest	24
asm-9.10.1.jar		pkg:maven/org.ow2.asm/asm@9.10.1		0		54
asm-commons-9.10.1.jar		pkg:maven/org.ow2.asm/asm-commons@9.10.1		0		58
asm-tree-9.10.1.jar		pkg:maven/org.ow2.asm/asm-tree@9.10.1		0		58
bcprov-jdk18on-1.84.jar	cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.84:::::::*	pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84		0	Highest	49
bcprov-jdk18on-1.85.2.jar	cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.85.2:::::::*	pkg:maven/org.bouncycastle/bcprov-jdk18on@1.85.2		0	Highest	49
byte-buddy-1.18.13-jdk5.jar		pkg:maven/net.bytebuddy/byte-buddy@1.18.13-jdk5		0		27
byte-buddy-agent-1.18.13-jdk5.jar		pkg:maven/net.bytebuddy/byte-buddy-agent@1.18.13-jdk5		0		31
byte-buddy-agent-1.18.13-jdk5.jar: attach_hotspot_windows.dll				0		2
byte-buddy-agent-1.18.13-jdk5.jar: attach_hotspot_windows.dll				0		2
byte-buddy-agent-1.18.13-jdk5.jar: attach_hotspot_windows.dll				0		2
caffeine-3.2.4.jar		pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4		0		33
checker-qual-4.2.3.jar		pkg:maven/org.checkerframework/checker-qual@4.2.3		0		44
com.github.waffle.demo.jakarta:waffle-demo-filter-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-form-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-jaas-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-mixed-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-mixed-post-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-negotiate-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-spring-boot-filter3:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-spring-filter-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo.jakarta:waffle-demo-spring-form-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-filter:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-form:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-jaas:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-mixed-post:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-mixed:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-negotiate:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-spring-boot-filter2:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-spring-filter:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT		0		6
com.github.waffle.demo:waffle-demo-spring-form:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-jetty-jakarta:3.6.1-SNAPSHOT	cpe:2.3:a:jetty:jetty:3.6.1:snapshot::::::	pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT		0	Low	6
com.github.waffle:waffle-jetty:3.6.1-SNAPSHOT	cpe:2.3:a:jetty:jetty:3.6.1:snapshot::::::	pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT		0	Low	6
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-jna:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-shiro-jakarta:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-shiro:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-boot-autoconfigure2:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-boot-autoconfigure3:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-boot-autoconfigure4:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-boot-starter2:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-boot-starter3:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-boot-starter4:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-security5:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-spring-security7:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-tomcat10:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-tomcat11:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-tomcat11@3.6.1-SNAPSHOT		0		6
com.github.waffle:waffle-tomcat9:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT		0		6
commons-beanutils-1.11.0.jar	cpe:2.3:a:apache:commons_beanutils:1.11.0:::::::*	pkg:maven/commons-beanutils/commons-beanutils@1.11.0		0	Highest	170
commons-logging-1.3.5.jar		pkg:maven/commons-logging/commons-logging@1.3.5		0		129
commons-logging-1.3.6.jar		pkg:maven/commons-logging/commons-logging@1.3.6		0		129
commons-logging-1.4.0.jar		pkg:maven/commons-logging/commons-logging@1.4.0		0		129
ecj-3.46.100.jar		pkg:maven/org.eclipse.jdt/ecj@3.46.100		0		36
encoder-1.4.0.jar		pkg:maven/org.owasp.encoder/encoder@1.4.0		0		33
error_prone_annotations-2.50.0.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0		0		29
expressly-6.0.0.jar		pkg:maven/org.glassfish.expressly/expressly@6.0.0		0		45
j2objc-annotations-3.1.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.1		0		33
jackson-annotations-2.21.jar	cpe:2.3:a:fasterxml:jackson-core:2.21:::::::* cpe:2.3:a:fasterxml:jackson-modules-java8:2.21:::::::*	pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21		0	Highest	36
jackson-annotations-2.22.jar	cpe:2.3:a:fasterxml:jackson-core:2.22:::::::* cpe:2.3:a:fasterxml:jackson-modules-java8:2.22:::::::*	pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.22		0	Highest	36
jackson-core-2.21.4.jar	cpe:2.3:a:fasterxml:jackson-core:2.21.4:::::::* cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:::::::*	pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4		0	Highest	47
jackson-core-2.22.2.jar	cpe:2.3:a:fasterxml:jackson-core:2.22.2:::::::* cpe:2.3:a:fasterxml:jackson-modules-java8:2.22.2:::::::*	pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.2		0	Highest	47
jackson-core-3.1.5.jar	cpe:2.3:a:fasterxml:jackson-core:3.1.5:::::::*	pkg:maven/tools.jackson.core/jackson-core@3.1.5		0	Highest	50
jackson-databind-2.21.4.jar	cpe:2.3:a:fasterxml:jackson-core:2.21.4:::::::* cpe:2.3:a:fasterxml:jackson-databind:2.21.4:::::::* cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:::::::*	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4	MEDIUM	1	Highest	41
jackson-databind-2.22.2.jar	cpe:2.3:a:fasterxml:jackson-core:2.22.2:::::::* cpe:2.3:a:fasterxml:jackson-databind:2.22.2:::::::* cpe:2.3:a:fasterxml:jackson-modules-java8:2.22.2:::::::*	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.2		0	Highest	41
jackson-databind-3.1.5.jar	cpe:2.3:a:fasterxml:jackson-core:3.1.5:::::::* cpe:2.3:a:fasterxml:jackson-databind:3.1.5:::::::*	pkg:maven/tools.jackson.core/jackson-databind@3.1.5		0	Highest	37
jackson-datatype-jdk8-2.21.4.jar	cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:::::::*	pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.21.4		0	Low	39
jackson-datatype-jdk8-2.22.2.jar	cpe:2.3:a:fasterxml:jackson-modules-java8:2.22.2:::::::*	pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.22.2		0	Low	39
jakarta.annotation-api-1.3.5.jar		pkg:maven/jakarta.annotation/jakarta.annotation-api@1.3.5		0		35
jakarta.annotation-api-2.1.1.jar		pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1		0		42
jakarta.annotation-api-3.0.0.jar		pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0		0		42
jakarta.el-3.0.4.jar	cpe:2.3:a:eclipse:jakarta_expression_language:3.0.4:::::::*	pkg:maven/org.glassfish/jakarta.el@3.0.4		0	Low	46
jakarta.el-api-3.0.3.jar	cpe:2.3:a:eclipse:jakarta_expression_language:3.0.3:::::::*	pkg:maven/jakarta.el/jakarta.el-api@3.0.3		0	Low	43
jakarta.el-api-6.0.1.jar	cpe:2.3:a:eclipse:jakarta_expression_language:6.0.1:::::::*	pkg:maven/jakarta.el/jakarta.el-api@6.0.1		0	Low	45
jakarta.servlet-api-4.0.2.jar		pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.2		0		41
jakarta.servlet-api-4.0.4.jar		pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.4		0		43
jakarta.servlet-api-6.0.0.jar		pkg:maven/jakarta.servlet/jakarta.servlet-api@6.0.0		0		44
jakarta.servlet-api-6.1.0.jar		pkg:maven/jakarta.servlet/jakarta.servlet-api@6.1.0		0		44
jakarta.servlet.jsp-2.3.6.jar	cpe:2.3:a:oracle:jsp:2.3.6:::::::*	pkg:maven/org.glassfish.web/jakarta.servlet.jsp@2.3.6		0	Medium	47
jakarta.servlet.jsp-3.0.0.jar		pkg:maven/org.glassfish.web/jakarta.servlet.jsp@3.0.0		0		47
jakarta.servlet.jsp-api-2.3.6.jar	cpe:2.3:a:oracle:jsp:2.3.6:::::::*	pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@2.3.6		0	Medium	45
jakarta.servlet.jsp-api-4.0.0.jar		pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@4.0.0		0		45
jakarta.servlet.jsp.jstl-1.2.6.jar	cpe:2.3:a:oracle:jsp:1.2.6:::::::*	pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6		0	Highest	48
jakarta.servlet.jsp.jstl-3.0.1.jar	cpe:2.3:a:oracle:jsp:3.0.1:::::::*	pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@3.0.1		0	Medium	47
jakarta.servlet.jsp.jstl-api-1.2.4.jar	cpe:2.3:a:oracle:jsp:1.2.4:::::::*	pkg:maven/jakarta.servlet.jsp.jstl/jakarta.servlet.jsp.jstl-api@1.2.4		0	Medium	47
jdtcore-3.1.0.jar		pkg:maven/eclipse/jdtcore@3.1.0		0		25
jdtcore-3.1.0.jar: jdtCompilerAdapter.jar				0		7
jetty-io-12.1.13.jar	cpe:2.3:a:eclipse:jetty:12.1.13:::::::* cpe:2.3:a:jetty:jetty:12.1.13:::::::* cpe:2.3:a:mortbay_jetty:jetty:12.1.13:::::::*	pkg:maven/org.eclipse.jetty/jetty-io@12.1.13		0	Highest	33
jetty-server-12.1.13.jar	cpe:2.3:a:eclipse:jetty:12.1.13:::::::* cpe:2.3:a:jetty:jetty:12.1.13:::::::* cpe:2.3:a:jetty:jetty_http_server:12.1.13:::::::* cpe:2.3:a:mortbay_jetty:jetty:12.1.13:::::::*	pkg:maven/org.eclipse.jetty/jetty-server@12.1.13		0	Highest	33
jetty-servlet-api-4.0.9.jar		pkg:maven/org.eclipse.jetty.toolchain/jetty-servlet-api@4.0.9		0		33
jna-5.19.1.jar		pkg:maven/net.java.dev.jna/jna@5.19.1		0		48
jna-5.19.1.jar: jnidispatch.dll				0		2
jna-5.19.1.jar: jnidispatch.dll				0		2
jna-5.19.1.jar: jnidispatch.dll				0		2
jna-platform-5.19.1.jar		pkg:maven/net.java.dev.jna/jna-platform@5.19.1		0		42
jspecify-1.0.0.jar		pkg:maven/org.jspecify/jspecify@1.0.0		0		32
jspecify-1.0.1.jar	cpe:2.3:a:google:gmail:1.0.1:::::::*	pkg:maven/org.jspecify/jspecify@1.0.1		0	Low	44
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
jul-to-slf4j-1.7.36.jar		pkg:maven/org.slf4j/jul-to-slf4j@1.7.36		0		28
jul-to-slf4j-2.0.18.jar		pkg:maven/org.slf4j/jul-to-slf4j@2.0.18		0		31
jul-to-slf4j-2.0.19.jar		pkg:maven/org.slf4j/jul-to-slf4j@2.0.19		0		31
log4j-api-2.26.1.jar	cpe:2.3:a:apache:log4j:2.26.1:::::::*	pkg:maven/org.apache.logging.log4j/log4j-api@2.26.1		0	Highest	43
logback-core-1.5.34.jar	cpe:2.3:a:qos:logback:1.5.34:::::::*	pkg:maven/ch.qos.logback/logback-core@1.5.34		0	Highest	39
logback-core-1.5.38.jar	cpe:2.3:a:qos:logback:1.5.38:::::::*	pkg:maven/ch.qos.logback/logback-core@1.5.38		0	Highest	38
logback-core-1.6.3.jar	cpe:2.3:a:qos:logback:1.6.3:::::::*	pkg:maven/ch.qos.logback/logback-core@1.6.3		0	Highest	38
micrometer-commons-1.15.12.jar		pkg:maven/io.micrometer/micrometer-commons@1.15.12		0		65
micrometer-commons-1.16.7.jar		pkg:maven/io.micrometer/micrometer-commons@1.16.7		0		69
micrometer-commons-1.17.1.jar		pkg:maven/io.micrometer/micrometer-commons@1.17.1		0		69
micrometer-observation-1.15.12.jar		pkg:maven/io.micrometer/micrometer-observation@1.15.12		0		65
micrometer-observation-1.16.7.jar		pkg:maven/io.micrometer/micrometer-observation@1.16.7		0		69
micrometer-observation-1.17.1.jar		pkg:maven/io.micrometer/micrometer-observation@1.17.1		0		69
mockito-core-5.23.0.jar		pkg:maven/org.mockito/mockito-core@5.23.0		0		41
mortbay-apache-el-10.1.56.jar		pkg:maven/org.mortbay.jasper/mortbay-apache-el@10.1.56		0		36
mortbay-apache-el-9.0.119.jar		pkg:maven/org.mortbay.jasper/mortbay-apache-el@9.0.119		0		33
mortbay-apache-jsp-10.1.56.jar		pkg:maven/org.mortbay.jasper/mortbay-apache-jsp@10.1.56		0		34
mortbay-apache-jsp-9.0.119.jar		pkg:maven/org.mortbay.jasper/mortbay-apache-jsp@9.0.119		0		36
objenesis-3.6.jar		pkg:maven/org.objenesis/objenesis@3.6		0		29
shiro-core-2.2.1.jar	cpe:2.3:a:apache:shiro:2.2.1:::::::*	pkg:maven/org.apache.shiro/shiro-core@2.2.1	MEDIUM	1	Highest	33
shiro-core-3.0.1.jar	cpe:2.3:a:apache:shiro:3.0.1:::::::*	pkg:maven/org.apache.shiro/shiro-core@3.0.1		0	Highest	135
slf4j-api-2.0.18.jar		pkg:maven/org.slf4j/slf4j-api@2.0.18		0		29
slf4j-api-2.0.19.jar		pkg:maven/org.slf4j/slf4j-api@2.0.19		0		29
slf4j-simple-2.0.19.jar		pkg:maven/org.slf4j/slf4j-simple@2.0.19		0		37
snakeyaml-2.4.jar	cpe:2.3:a:snakeyaml_project:snakeyaml:2.4:::::::*	pkg:maven/org.yaml/snakeyaml@2.4		0	Highest	42
snakeyaml-2.6.jar	cpe:2.3:a:snakeyaml_project:snakeyaml:2.6:::::::*	pkg:maven/org.yaml/snakeyaml@2.6		0	Highest	42
snakeyaml-2.7.jar	cpe:2.3:a:snakeyaml_project:snakeyaml:2.7:::::::*	pkg:maven/org.yaml/snakeyaml@2.7		0	Highest	42
spotbugs-annotations-4.10.4.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4		0		53
spring-boot-2.7.18.jar	cpe:2.3:a:vmware:spring_boot:2.7.18:::::::*	pkg:maven/org.springframework.boot/spring-boot@2.7.18	CRITICAL	7	Highest	38
spring-boot-3.5.16.jar	cpe:2.3:a:vmware:spring_boot:3.5.16:::::::*	pkg:maven/org.springframework.boot/spring-boot@3.5.16		0	Highest	38
spring-boot-web-server-4.1.1.jar	cpe:2.3:a:vmware:spring_boot:4.1.1:::::::*	pkg:maven/org.springframework.boot/spring-boot-web-server@4.1.1		0	Highest	42
spring-core-5.3.39.jar	cpe:2.3:a:pivotal_software:spring_framework:5.3.39:::::::* cpe:2.3:a:springsource:spring_framework:5.3.39:::::::* cpe:2.3:a:vmware:spring_framework:5.3.39:::::::*	pkg:maven/org.springframework/spring-core@5.3.39	CRITICAL	36	Highest	37
spring-core-6.2.19.jar	cpe:2.3:a:pivotal_software:spring_framework:6.2.19:::::::* cpe:2.3:a:springsource:spring_framework:6.2.19:::::::* cpe:2.3:a:vmware:spring_framework:6.2.19:::::::*	pkg:maven/org.springframework/spring-core@6.2.19	CRITICAL	17	Highest	41
spring-core-7.0.9.jar	cpe:2.3:a:pivotal_software:spring_framework:7.0.9:::::::* cpe:2.3:a:springsource:spring_framework:7.0.9:::::::* cpe:2.3:a:vmware:spring_framework:7.0.9:::::::*	pkg:maven/org.springframework/spring-core@7.0.9		0	Highest	41
spring-security-core-5.8.16.jar	cpe:2.3:a:pivotal_software:spring_security:5.8.16:::::::* cpe:2.3:a:vmware:spring_security:5.8.16:::::::*	pkg:maven/org.springframework.security/spring-security-core@5.8.16	CRITICAL	11	Highest	38
spring-security-core-6.5.11.jar	cpe:2.3:a:pivotal_software:spring_security:6.5.11:::::::* cpe:2.3:a:vmware:spring_security:6.5.11:::::::*	pkg:maven/org.springframework.security/spring-security-core@6.5.11	CRITICAL	4	Highest	38
spring-security-core-7.1.1.jar	cpe:2.3:a:pivotal_software:spring_security:7.1.1:::::::* cpe:2.3:a:vmware:spring_security:7.1.1:::::::*	pkg:maven/org.springframework.security/spring-security-core@7.1.1		0	Highest	38
spring-security-web-6.5.11.jar: spring-security-webauthn.js				0		0
spring-web-5.3.39.jar	cpe:2.3:a:pivotal_software:spring_framework:5.3.39:::::::* cpe:2.3:a:springsource:spring_framework:5.3.39:::::::* cpe:2.3:a:vmware:spring_framework:5.3.39:::::::*	pkg:maven/org.springframework/spring-web@5.3.39	CRITICAL	37	Highest	35
tomcat-annotations-api-10.1.59.jar	cpe:2.3:a:www-sql_project:www-sql:10.1.59:::::::*	pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.59		0	Low	30
tomcat-annotations-api-11.0.25.jar	cpe:2.3:a:www-sql_project:www-sql:11.0.25:::::::*	pkg:maven/org.apache.tomcat/tomcat-annotations-api@11.0.25		0	Low	30
tomcat-annotations-api-9.0.121.jar	cpe:2.3:a:www-sql_project:www-sql:9.0.121:::::::*	pkg:maven/org.apache.tomcat/tomcat-annotations-api@9.0.121		0	Low	30
tomcat-api-10.1.59.jar	cpe:2.3:a:apache:tomcat:10.1.59:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:10.1.59:::::::*	pkg:maven/org.apache.tomcat/tomcat-api@10.1.59		0	Highest	24
tomcat-api-11.0.25.jar	cpe:2.3:a:apache:tomcat:11.0.25:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:11.0.25:::::::*	pkg:maven/org.apache.tomcat/tomcat-api@11.0.25		0	Highest	24
tomcat-el-api-10.1.59.jar		pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.59		0		25
tomcat-el-api-11.0.25.jar		pkg:maven/org.apache.tomcat/tomcat-el-api@11.0.25		0		25
tomcat-el-api-9.0.121.jar		pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.121		0		25
tomcat-embed-core-10.1.55.jar	cpe:2.3:a:apache:tomcat:10.1.55:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:10.1.55:::::::*	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55	CRITICAL	19	Highest	63
tomcat-embed-core-11.0.24.jar	cpe:2.3:a:apache:tomcat:11.0.24:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:11.0.24:::::::*	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.24	CRITICAL	11	Highest	63
tomcat-embed-core-9.0.121.jar	cpe:2.3:a:apache:tomcat:9.0.121:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.121:::::::*	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.121		0	Highest	65
tomcat-embed-el-10.1.55.jar		pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@10.1.55		0		33
tomcat-embed-el-11.0.24.jar		pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@11.0.24		0		33
tomcat-embed-el-9.0.121.jar		pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@9.0.121		0		33
tomcat-jni-10.1.59.jar		pkg:maven/org.apache.tomcat/tomcat-jni@10.1.59		0		26
tomcat-jni-11.0.25.jar		pkg:maven/org.apache.tomcat/tomcat-jni@11.0.25		0		26
tomcat-jni-9.0.121.jar		pkg:maven/org.apache.tomcat/tomcat-jni@9.0.121		0		26
tomcat-juli-10.1.59.jar		pkg:maven/org.apache.tomcat/tomcat-juli@10.1.59		0		26
tomcat-juli-11.0.25.jar		pkg:maven/org.apache.tomcat/tomcat-juli@11.0.25		0		26
tomcat-juli-9.0.121.jar		pkg:maven/org.apache.tomcat/tomcat-juli@9.0.121		0		26
tomcat-servlet-api-10.1.59.jar		pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.59		0		39
tomcat-servlet-api-11.0.25.jar		pkg:maven/org.apache.tomcat/tomcat-servlet-api@11.0.25		0		39
tomcat-servlet-api-9.0.121.jar		pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.121		0		39

File Path: /home/runner/.m2/repository/org/apache/ant/ant/1.10.8/ant-1.10.8.jar
MD5: 4492182f592ad9779a5de60e3f0ea3c4
SHA1: ae148abb0532b685c5eeb22fdec9d124e89be5de
SHA256:b96b46fd2b4b00e42684c3085b0d16dde975e7b8e64822b0bf52edf5fd387d8d
Referenced In Project/Scope: waffle-jetty-jakarta:provided
ant-1.10.8.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.glassfish.web/jakarta.servlet.jsp@3.0.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ant	High
Vendor	jar	package name	ant	Highest
Vendor	jar	package name	apache	Highest
Vendor	manifest: org/apache/tools/ant/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	ant	Highest
Vendor	pom	artifactid	ant	Low
Vendor	pom	groupid	org.apache.ant	Highest
Vendor	pom	name	Apache Ant Core	High
Vendor	pom	parent-artifactid	ant-parent	Low
Vendor	pom	url	https://ant.apache.org/	Highest
Product	file	name	ant	High
Product	jar	package name	ant	Highest
Product	jar	package name	apache	Highest
Product	jar	package name	tools	Highest
Product	manifest: org/apache/tools/ant/	Implementation-Title	org.apache.tools.ant	Medium
Product	manifest: org/apache/tools/ant/	Specification-Title	Apache Ant	Medium
Product	pom	artifactid	ant	Highest
Product	pom	groupid	org.apache.ant	Highest
Product	pom	name	Apache Ant Core	High
Product	pom	parent-artifactid	ant-parent	Medium
Product	pom	url	https://ant.apache.org/	Medium
Version	file	version	1.10.8	High
Version	manifest: org/apache/tools/ant/	Implementation-Version	1.10.8	Medium
Version	pom	version	1.10.8	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.ant/ant@1.10.8 (Confidence:High)
cpe:2.3:a:apache:ant:1.10.8:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CWE-379 Creation of Temporary File in Directory with Insecure Permissions, NVD-CWE-Other

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/
af854a3a-2127-422b-91ae-364da2661108 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/
af854a3a-2127-422b-91ae-364da2661108 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E
security@apache.org - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/
security@apache.org - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/
security@apache.org - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/
security@apache.org - MAILING_LIST,VENDOR_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-78254

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. 




In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.




For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.




Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the  old behavior is required by existing build files.




Mitigations:




Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.




All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

CWE-23 Relative Path Traversal

CVSSv3:

Base Score: HIGH (7.4)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:* versions up to (excluding) 1.10.18

CVE-2021-36373

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

CWE-130 Improper Handling of Length Parameter Inconsistency, NVD-CWE-Other

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - NOT_APPLICABLE
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
security@apache.org - MAILING_LIST,VENDOR_ADVISORY
security@apache.org - NOT_APPLICABLE
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2021-36374

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

CWE-130 Improper Handling of Length Parameter Inconsistency, NVD-CWE-Other

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3E
security@apache.org - https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3E
security@apache.org - MAILING_LIST,VENDOR_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html

File Path: /home/runner/.m2/repository/org/ow2/asm/asm/9.10.1/asm-9.10.1.jar
MD5: 9cb72080438acf27f2607002e1444a7b
SHA1: ada2141c0cc52ee8f5c48cd5fa4ce0e794f22236
SHA256:ed825d10ab1399c8c0cb669e688cf0c8c82629b4c8399b58352b68e92ca10fcb
Referenced In Projects/Scopes:

waffle-jetty-jakarta:provided
waffle-jetty:provided

pkg:maven/org.ow2.asm/asm-commons@9.10.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	asm	High
Vendor	jar	package name	asm	Highest
Vendor	jar	package name	objectweb	Highest
Vendor	Manifest	bundle-docurl	http://asm.ow2.org	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Vendor	Manifest	bundle-symbolicname	org.objectweb.asm	Medium
Vendor	pom	artifactid	asm	Highest
Vendor	pom	artifactid	asm	Low
Vendor	pom	developer email	ebruneton@free.fr	Low
Vendor	pom	developer email	eu@javatx.org	Low
Vendor	pom	developer email	forax@univ-mlv.fr	Low
Vendor	pom	developer id	ebruneton	Medium
Vendor	pom	developer id	eu	Medium
Vendor	pom	developer id	forax	Medium
Vendor	pom	developer name	Eric Bruneton	Medium
Vendor	pom	developer name	Eugene Kuleshov	Medium
Vendor	pom	developer name	Remi Forax	Medium
Vendor	pom	groupid	org.ow2.asm	Highest
Vendor	pom	name	asm	High
Vendor	pom	organization name	OW2	High
Vendor	pom	organization url	http://www.ow2.org/	Medium
Vendor	pom	parent-artifactid	ow2	Low
Vendor	pom	parent-groupid	org.ow2	Medium
Vendor	pom	url	http://asm.ow2.io/	Highest
Product	file	name	asm	High
Product	jar	package name	asm	Highest
Product	jar	package name	objectweb	Highest
Product	Manifest	bundle-docurl	http://asm.ow2.org	Low
Product	Manifest	Bundle-Name	org.objectweb.asm	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Product	Manifest	bundle-symbolicname	org.objectweb.asm	Medium
Product	Manifest	Implementation-Title	ASM, a very small and fast Java bytecode manipulation framework	High
Product	pom	artifactid	asm	Highest
Product	pom	developer email	ebruneton@free.fr	Low
Product	pom	developer email	eu@javatx.org	Low
Product	pom	developer email	forax@univ-mlv.fr	Low
Product	pom	developer id	ebruneton	Low
Product	pom	developer id	eu	Low
Product	pom	developer id	forax	Low
Product	pom	developer name	Eric Bruneton	Low
Product	pom	developer name	Eugene Kuleshov	Low
Product	pom	developer name	Remi Forax	Low
Product	pom	groupid	org.ow2.asm	Highest
Product	pom	name	asm	High
Product	pom	organization name	OW2	Low
Product	pom	organization url	http://www.ow2.org/	Low
Product	pom	parent-artifactid	ow2	Medium
Product	pom	parent-groupid	org.ow2	Medium
Product	pom	url	http://asm.ow2.io/	Medium
Version	file	version	9.10.1	High
Version	Manifest	Bundle-Version	9.10.1	High
Version	Manifest	Implementation-Version	9.10.1	High
Version	pom	parent-version	9.10.1	Low
Version	pom	version	9.10.1	Highest

Identifiers

pkg:maven/org.ow2.asm/asm@9.10.1 (Confidence:High)

Description:

Usefull class adapters based on ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html

File Path: /home/runner/.m2/repository/org/ow2/asm/asm-commons/9.10.1/asm-commons-9.10.1.jar
MD5: 8eee0b1bdd046baf472eb83dd5e6bb44
SHA1: 4229e4c55fd8e01c23f9fe9884075cc628aacc50
SHA256:6d0abefb7cbf972ea16edb37ec14835372505063a45f976ab7ea889ed9497895
Referenced In Projects/Scopes:

waffle-jetty-jakarta:provided
waffle-jetty:provided

pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	asm-commons	High
Vendor	jar	package name	asm	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	objectweb	Highest
Vendor	Manifest	bundle-docurl	http://asm.ow2.org	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Vendor	Manifest	bundle-symbolicname	org.objectweb.asm.commons	Medium
Vendor	Manifest	module-requires	org.objectweb.asm;transitive=true,org.objectweb.asm.tree;transitive=true	Low
Vendor	pom	artifactid	asm-commons	Highest
Vendor	pom	artifactid	asm-commons	Low
Vendor	pom	developer email	ebruneton@free.fr	Low
Vendor	pom	developer email	eu@javatx.org	Low
Vendor	pom	developer email	forax@univ-mlv.fr	Low
Vendor	pom	developer id	ebruneton	Medium
Vendor	pom	developer id	eu	Medium
Vendor	pom	developer id	forax	Medium
Vendor	pom	developer name	Eric Bruneton	Medium
Vendor	pom	developer name	Eugene Kuleshov	Medium
Vendor	pom	developer name	Remi Forax	Medium
Vendor	pom	groupid	org.ow2.asm	Highest
Vendor	pom	name	asm-commons	High
Vendor	pom	organization name	OW2	High
Vendor	pom	organization url	http://www.ow2.org/	Medium
Vendor	pom	parent-artifactid	ow2	Low
Vendor	pom	parent-groupid	org.ow2	Medium
Vendor	pom	url	http://asm.ow2.io/	Highest
Product	file	name	asm-commons	High
Product	jar	package name	asm	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	objectweb	Highest
Product	Manifest	bundle-docurl	http://asm.ow2.org	Low
Product	Manifest	Bundle-Name	org.objectweb.asm.commons	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Product	Manifest	bundle-symbolicname	org.objectweb.asm.commons	Medium
Product	Manifest	Implementation-Title	Usefull class adapters based on ASM, a very small and fast Java bytecode manipulation framework	High
Product	Manifest	module-requires	org.objectweb.asm;transitive=true,org.objectweb.asm.tree;transitive=true	Low
Product	pom	artifactid	asm-commons	Highest
Product	pom	developer email	ebruneton@free.fr	Low
Product	pom	developer email	eu@javatx.org	Low
Product	pom	developer email	forax@univ-mlv.fr	Low
Product	pom	developer id	ebruneton	Low
Product	pom	developer id	eu	Low
Product	pom	developer id	forax	Low
Product	pom	developer name	Eric Bruneton	Low
Product	pom	developer name	Eugene Kuleshov	Low
Product	pom	developer name	Remi Forax	Low
Product	pom	groupid	org.ow2.asm	Highest
Product	pom	name	asm-commons	High
Product	pom	organization name	OW2	Low
Product	pom	organization url	http://www.ow2.org/	Low
Product	pom	parent-artifactid	ow2	Medium
Product	pom	parent-groupid	org.ow2	Medium
Product	pom	url	http://asm.ow2.io/	Medium
Version	file	version	9.10.1	High
Version	Manifest	Bundle-Version	9.10.1	High
Version	Manifest	Implementation-Version	9.10.1	High
Version	pom	parent-version	9.10.1	Low
Version	pom	version	9.10.1	Highest

Identifiers

pkg:maven/org.ow2.asm/asm-commons@9.10.1 (Confidence:High)

Description:

Tree API of ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html

File Path: /home/runner/.m2/repository/org/ow2/asm/asm-tree/9.10.1/asm-tree-9.10.1.jar
MD5: 62541e1dc62331408ef31317555bf4fa
SHA1: e244332a17564c1d1572449399a842de35881be2
SHA256:3dfb0d5b6a106cd40b5b250e39935fbf2f927f4477546a5369a3ac609cf0506b
Referenced In Projects/Scopes:

waffle-jetty-jakarta:provided
waffle-jetty:provided

pkg:maven/org.ow2.asm/asm-commons@9.10.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	asm-tree	High
Vendor	jar	package name	asm	Highest
Vendor	jar	package name	objectweb	Highest
Vendor	jar	package name	tree	Highest
Vendor	Manifest	bundle-docurl	http://asm.ow2.org	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Vendor	Manifest	bundle-symbolicname	org.objectweb.asm.tree	Medium
Vendor	Manifest	module-requires	org.objectweb.asm;transitive=true	Low
Vendor	pom	artifactid	asm-tree	Highest
Vendor	pom	artifactid	asm-tree	Low
Vendor	pom	developer email	ebruneton@free.fr	Low
Vendor	pom	developer email	eu@javatx.org	Low
Vendor	pom	developer email	forax@univ-mlv.fr	Low
Vendor	pom	developer id	ebruneton	Medium
Vendor	pom	developer id	eu	Medium
Vendor	pom	developer id	forax	Medium
Vendor	pom	developer name	Eric Bruneton	Medium
Vendor	pom	developer name	Eugene Kuleshov	Medium
Vendor	pom	developer name	Remi Forax	Medium
Vendor	pom	groupid	org.ow2.asm	Highest
Vendor	pom	name	asm-tree	High
Vendor	pom	organization name	OW2	High
Vendor	pom	organization url	http://www.ow2.org/	Medium
Vendor	pom	parent-artifactid	ow2	Low
Vendor	pom	parent-groupid	org.ow2	Medium
Vendor	pom	url	http://asm.ow2.io/	Highest
Product	file	name	asm-tree	High
Product	jar	package name	asm	Highest
Product	jar	package name	objectweb	Highest
Product	jar	package name	tree	Highest
Product	Manifest	bundle-docurl	http://asm.ow2.org	Low
Product	Manifest	Bundle-Name	org.objectweb.asm.tree	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Product	Manifest	bundle-symbolicname	org.objectweb.asm.tree	Medium
Product	Manifest	Implementation-Title	Tree API of ASM, a very small and fast Java bytecode manipulation framework	High
Product	Manifest	module-requires	org.objectweb.asm;transitive=true	Low
Product	pom	artifactid	asm-tree	Highest
Product	pom	developer email	ebruneton@free.fr	Low
Product	pom	developer email	eu@javatx.org	Low
Product	pom	developer email	forax@univ-mlv.fr	Low
Product	pom	developer id	ebruneton	Low
Product	pom	developer id	eu	Low
Product	pom	developer id	forax	Low
Product	pom	developer name	Eric Bruneton	Low
Product	pom	developer name	Eugene Kuleshov	Low
Product	pom	developer name	Remi Forax	Low
Product	pom	groupid	org.ow2.asm	Highest
Product	pom	name	asm-tree	High
Product	pom	organization name	OW2	Low
Product	pom	organization url	http://www.ow2.org/	Low
Product	pom	parent-artifactid	ow2	Medium
Product	pom	parent-groupid	org.ow2	Medium
Product	pom	url	http://asm.ow2.io/	Medium
Version	file	version	9.10.1	High
Version	Manifest	Bundle-Version	9.10.1	High
Version	Manifest	Implementation-Version	9.10.1	High
Version	pom	parent-version	9.10.1	Low
Version	pom	version	9.10.1	Highest

Identifiers

pkg:maven/org.ow2.asm/asm-tree@9.10.1 (Confidence:High)

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the  JCA/JCE provider and low-level API for the BC Java version 1.84 for Java 1.8 and later.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html

File Path: /home/runner/.m2/repository/org/bouncycastle/bcprov-jdk18on/1.84/bcprov-jdk18on-1.84.jar
MD5: 19523b0cbcbce2fdeb98e3eaf68f602e
SHA1: 2d5651789941d2f8ae9b8771f23356de6b61e96b
SHA256:64d6c5a6121fcd927152dd182cbed39afe0fda641a970d9bcc0c9cb1858b2731
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/org.apache.shiro/shiro-web@2.2.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bcprov-jdk18on	High
Vendor	jar	package name	bc	Highest
Vendor	jar	package name	bouncycastle	Highest
Vendor	jar	package name	crypto	Highest
Vendor	jar	package name	jce	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	provider	Highest
Vendor	Manifest	application-library-allowable-codebase	*	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Vendor	Manifest	bundle-symbolicname	bcprov	Medium
Vendor	Manifest	caller-allowable-codebase	*	Low
Vendor	Manifest	codebase	*	Low
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	permissions	all-permissions	Low
Vendor	Manifest	trusted-library	true	Low
Vendor	pom	artifactid	bcprov-jdk18on	Highest
Vendor	pom	artifactid	bcprov-jdk18on	Low
Vendor	pom	developer email	feedback-crypto@bouncycastle.org	Low
Vendor	pom	developer id	feedback-crypto	Medium
Vendor	pom	developer name	The Legion of the Bouncy Castle Inc.	Medium
Vendor	pom	groupid	org.bouncycastle	Highest
Vendor	pom	name	Bouncy Castle Provider	High
Vendor	pom	url	https://www.bouncycastle.org/download/bouncy-castle-java/	Highest
Product	file	name	bcprov-jdk18on	High
Product	jar	package name	bc	Highest
Product	jar	package name	bouncycastle	Highest
Product	jar	package name	crypto	Highest
Product	jar	package name	jce	Highest
Product	jar	package name	org	Highest
Product	jar	package name	provider	Highest
Product	Manifest	application-library-allowable-codebase	*	Low
Product	Manifest	Bundle-Name	bcprov	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Product	Manifest	bundle-symbolicname	bcprov	Medium
Product	Manifest	caller-allowable-codebase	*	Low
Product	Manifest	codebase	*	Low
Product	Manifest	multi-release	true	Low
Product	Manifest	permissions	all-permissions	Low
Product	Manifest	trusted-library	true	Low
Product	pom	artifactid	bcprov-jdk18on	Highest
Product	pom	developer email	feedback-crypto@bouncycastle.org	Low
Product	pom	developer id	feedback-crypto	Low
Product	pom	developer name	The Legion of the Bouncy Castle Inc.	Low
Product	pom	groupid	org.bouncycastle	Highest
Product	pom	name	Bouncy Castle Provider	High
Product	pom	url	https://www.bouncycastle.org/download/bouncy-castle-java/	Medium
Version	file	version	1.84	High
Version	Manifest	Bundle-Version	1.84	High
Version	pom	version	1.84	Highest

Identifiers

pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84 (Confidence:High)
cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.84:*:*:*:*:*:*:* (Confidence:Highest)

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the  JCA/JCE provider and low-level API for the BC Java version 1.85.2 for Java 1.8 and later.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html

File Path: /home/runner/.m2/repository/org/bouncycastle/bcprov-jdk18on/1.85.2/bcprov-jdk18on-1.85.2.jar
MD5: 9eaa522def18463e3d8a559ac4c37492
SHA1: aeb3dac02f799ed4783d5ed5900513339880727f
SHA256:986b0fb92ec10e0c66b43e036ce0077e6150cfaecd1db9fb92b56672e157afe5
Referenced In Project/Scope: waffle-shiro-jakarta:provided
pkg:maven/org.apache.shiro/shiro-web@3.0.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bcprov-jdk18on	High
Vendor	jar	package name	bc	Highest
Vendor	jar	package name	bouncycastle	Highest
Vendor	jar	package name	crypto	Highest
Vendor	jar	package name	jce	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	provider	Highest
Vendor	Manifest	application-library-allowable-codebase	*	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Vendor	Manifest	bundle-symbolicname	bcprov	Medium
Vendor	Manifest	caller-allowable-codebase	*	Low
Vendor	Manifest	codebase	*	Low
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	permissions	all-permissions	Low
Vendor	Manifest	trusted-library	true	Low
Vendor	pom	artifactid	bcprov-jdk18on	Highest
Vendor	pom	artifactid	bcprov-jdk18on	Low
Vendor	pom	developer email	feedback-crypto@bouncycastle.org	Low
Vendor	pom	developer id	feedback-crypto	Medium
Vendor	pom	developer name	The Legion of the Bouncy Castle Inc.	Medium
Vendor	pom	groupid	org.bouncycastle	Highest
Vendor	pom	name	Bouncy Castle Provider	High
Vendor	pom	url	https://www.bouncycastle.org/download/bouncy-castle-java/	Highest
Product	file	name	bcprov-jdk18on	High
Product	jar	package name	bc	Highest
Product	jar	package name	bouncycastle	Highest
Product	jar	package name	crypto	Highest
Product	jar	package name	jce	Highest
Product	jar	package name	org	Highest
Product	jar	package name	provider	Highest
Product	Manifest	application-library-allowable-codebase	*	Low
Product	Manifest	Bundle-Name	bcprov	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Product	Manifest	bundle-symbolicname	bcprov	Medium
Product	Manifest	caller-allowable-codebase	*	Low
Product	Manifest	codebase	*	Low
Product	Manifest	multi-release	true	Low
Product	Manifest	permissions	all-permissions	Low
Product	Manifest	trusted-library	true	Low
Product	pom	artifactid	bcprov-jdk18on	Highest
Product	pom	developer email	feedback-crypto@bouncycastle.org	Low
Product	pom	developer id	feedback-crypto	Low
Product	pom	developer name	The Legion of the Bouncy Castle Inc.	Low
Product	pom	groupid	org.bouncycastle	Highest
Product	pom	name	Bouncy Castle Provider	High
Product	pom	url	https://www.bouncycastle.org/download/bouncy-castle-java/	Medium
Version	file	version	1.85.2	High
Version	Manifest	Bundle-Version	1.85.2	High
Version	pom	version	1.85.2	Highest

Identifiers

pkg:maven/org.bouncycastle/bcprov-jdk18on@1.85.2 (Confidence:High)
cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.85.2:*:*:*:*:*:*:* (Confidence:Highest)

Description:

        Byte Buddy is a Java library for creating Java classes at run time.
        This artifact is a build of Byte Buddy with all ASM dependencies repackaged into its own name space.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/net/bytebuddy/byte-buddy/1.18.13-jdk5/byte-buddy-1.18.13-jdk5.jar
MD5: e7a23aeb09831e073d8a7384cbd622a0
SHA1: 2825af2e20ed3dfc81c0b41ed407b5e1850177ec
SHA256:4c3ba3487fe10851bd9e1218091c32e8aae0187ee2f257298d9900ab906c5391
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

pkg:maven/org.mockito/mockito-core@5.23.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	byte-buddy	High
Vendor	jar	package name	asm	Highest
Vendor	jar	package name	build	Highest
Vendor	jar	package name	bytebuddy	Highest
Vendor	jar	package name	net	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-symbolicname	net.bytebuddy.byte-buddy	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	byte-buddy	Highest
Vendor	pom	artifactid	byte-buddy	Low
Vendor	pom	groupid	net.bytebuddy	Highest
Vendor	pom	name	Byte Buddy (without dependencies)	High
Vendor	pom	parent-artifactid	byte-buddy-parent	Low
Product	file	name	byte-buddy	High
Product	jar	package name	asm	Highest
Product	jar	package name	build	Highest
Product	jar	package name	bytebuddy	Highest
Product	jar	package name	net	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	Bundle-Name	Byte Buddy (without dependencies)	Medium
Product	Manifest	bundle-symbolicname	net.bytebuddy.byte-buddy	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	byte-buddy	Highest
Product	pom	groupid	net.bytebuddy	Highest
Product	pom	name	Byte Buddy (without dependencies)	High
Product	pom	parent-artifactid	byte-buddy-parent	Medium
Version	pom	version	1.18.13-jdk5	Highest

Identifiers

pkg:maven/net.bytebuddy/byte-buddy@1.18.13-jdk5 (Confidence:High)

Description:

The Byte Buddy agent offers convenience for attaching an agent to the local or a remote VM.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.13-jdk5/byte-buddy-agent-1.18.13-jdk5.jar
MD5: 3939084da89e78cafe303d498b426d4b
SHA1: ca78a7f92b2bd5e7d0679ad6a4343ca9835dd36a
SHA256:76ada1b597219f42fbb05ff80553fa3d1f3a19998d44ac29714865b75a4043cd
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

pkg:maven/org.mockito/mockito-core@5.23.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	byte-buddy-agent	High
Vendor	jar	package name	agent	Highest
Vendor	jar	package name	bytebuddy	Highest
Vendor	jar	package name	net	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-symbolicname	net.bytebuddy.byte-buddy-agent	Medium
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	Manifest	can-retransform-classes	true	Low
Vendor	Manifest	can-set-native-method-prefix	true	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	byte-buddy-agent	Highest
Vendor	pom	artifactid	byte-buddy-agent	Low
Vendor	pom	groupid	net.bytebuddy	Highest
Vendor	pom	name	Byte Buddy agent	High
Vendor	pom	parent-artifactid	byte-buddy-parent	Low
Product	file	name	byte-buddy-agent	High
Product	jar	package name	agent	Highest
Product	jar	package name	bytebuddy	Highest
Product	jar	package name	net	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	Bundle-Name	Byte Buddy agent	Medium
Product	Manifest	bundle-symbolicname	net.bytebuddy.byte-buddy-agent	Medium
Product	Manifest	can-redefine-classes	true	Low
Product	Manifest	can-retransform-classes	true	Low
Product	Manifest	can-set-native-method-prefix	true	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	byte-buddy-agent	Highest
Product	pom	groupid	net.bytebuddy	Highest
Product	pom	name	Byte Buddy agent	High
Product	pom	parent-artifactid	byte-buddy-parent	Medium
Version	pom	version	1.18.13-jdk5	Highest

Identifiers

pkg:maven/net.bytebuddy/byte-buddy-agent@1.18.13-jdk5 (Confidence:High)

File Path: /home/runner/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.13-jdk5/byte-buddy-agent-1.18.13-jdk5.jar/win32-aarch64/attach_hotspot_windows.dll
MD5: c10189d72d992152e89f92bc6f7ebd8f
SHA1: 36441771d82581f1d8740f8ecba4e7d81c975715
SHA256:db8aaf585ad6e9730d54c91bbc4a59ed01facc57064e0e5aee51a37db795e093
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	attach_hotspot_windows	High
Product	file	name	attach_hotspot_windows	High

Identifiers

None

File Path: /home/runner/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.13-jdk5/byte-buddy-agent-1.18.13-jdk5.jar/win32-x86-64/attach_hotspot_windows.dll
MD5: 053a783e5777c6a9867c27d51af89677
SHA1: 5ef4d98ae6a033a5707d0b5466e6138beb337e76
SHA256:16d424423f9b09accf132ad35dbeaa52ac9f6bd45bba1406b89df851f651db20
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	attach_hotspot_windows	High
Product	file	name	attach_hotspot_windows	High

Identifiers

None

File Path: /home/runner/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.13-jdk5/byte-buddy-agent-1.18.13-jdk5.jar/win32-x86/attach_hotspot_windows.dll
MD5: fbca33102ac97be0ed496c0f78e466b3
SHA1: c4df05146a86a6d073769bb697d550ef42518ed5
SHA256:810f94c4a2f5ca1a072c19859f7954fed9aa3a1dcb0d601e92d2338793202e72
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	attach_hotspot_windows	High
Product	file	name	attach_hotspot_windows	High

Identifiers

None

Description:

A high performance caching library

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/github/ben-manes/caffeine/caffeine/3.2.4/caffeine-3.2.4.jar
MD5: 04d655feb58be297a86fa2814a1f1ef8
SHA1: c63b303adf59c733d2a96125ad6670e938a2c15d
SHA256:9d9d2cfd681fd9272ded3d27c9930db12f89f732345975aa113ebc223bbf1224
Referenced In Projects/Scopes:

waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	caffeine	High
Vendor	jar	package name	cache	Highest
Vendor	jar	package name	caffeine	Highest
Vendor	jar	package name	github	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	com.github.ben-manes.caffeine	Medium
Vendor	pom	artifactid	caffeine	Highest
Vendor	pom	artifactid	caffeine	Low
Vendor	pom	developer email	ben.manes@gmail.com	Low
Vendor	pom	developer id	ben-manes	Medium
Vendor	pom	developer name	Ben Manes	Medium
Vendor	pom	groupid	com.github.ben-manes.caffeine	Highest
Vendor	pom	name	Caffeine cache	High
Vendor	pom	url	ben-manes/caffeine	Highest
Product	file	name	caffeine	High
Product	jar	package name	cache	Highest
Product	jar	package name	caffeine	Highest
Product	jar	package name	github	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	com.github.ben-manes.caffeine	Medium
Product	Manifest	bundle-symbolicname	com.github.ben-manes.caffeine	Medium
Product	Manifest	Implementation-Title	A high performance caching library	High
Product	pom	artifactid	caffeine	Highest
Product	pom	developer email	ben.manes@gmail.com	Low
Product	pom	developer id	ben-manes	Low
Product	pom	developer name	Ben Manes	Low
Product	pom	groupid	com.github.ben-manes.caffeine	Highest
Product	pom	name	Caffeine cache	High
Product	pom	url	ben-manes/caffeine	High
Version	file	version	3.2.4	High
Version	Manifest	Bundle-Version	3.2.4	High
Version	Manifest	Implementation-Version	3.2.4	High
Version	pom	version	3.2.4	Highest

Identifiers

pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4 (Confidence:High)

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: https://opensource.org/licenses/MIT

File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/4.2.3/checker-qual-4.2.3.jar
MD5: d9e63a451931be32bd29cfc3ac5674c1
SHA1: d2a10af5c8574adfe24f5e35ff56cca92af2e916
SHA256:f868f731f6e37db3e1c2140d06016477989959a2d13fc5bed9c46760cffd5ba0
Referenced In Projects/Scopes:

waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

pkg:maven/com.github.hazendaz.jmockit/jmockit@2.3.0
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	4.2.3	High
Version	Manifest	Bundle-Version	4.2.3	High
Version	Manifest	Implementation-Version	4.2.3	High
Version	pom	version	4.2.3	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@4.2.3 (Confidence:High)

Description:

Filter Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-filter-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-filter-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-filter-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Form Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-form-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-form-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-form-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Jaas Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-jaas-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-jaas-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-jaas-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Mixed Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-mixed-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-mixed-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-mixed-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Mixed Post Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-mixed-post-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-mixed-post-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-mixed-post-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Negotiate Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-negotiate-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-negotiate-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-negotiate-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot Filter 3 Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-spring-boot-filter3/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-spring-boot-filter3	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-spring-boot-filter3	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Filter Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-spring-filter-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-spring-filter-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-spring-filter-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Form Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo-jakarta/waffle-demo-spring-form-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-spring-form-jakarta	Low
Vendor	project	groupid	com.github.waffle.demo.jakarta	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-spring-form-jakarta	Highest
Product	project	groupid	com.github.waffle.demo.jakarta	Low

Identifiers

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Filter Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-filter/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-filter	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-filter	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Form Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-form/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-form	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-form	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Jaas Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-jaas/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-jaas	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-jaas	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Mixed Post Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-mixed-post/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-mixed-post	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-mixed-post	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Mixed Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-mixed/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-mixed	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-mixed	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Negotiate Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-negotiate/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-negotiate	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-negotiate	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot Filter 2 Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-spring-boot-filter2/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-spring-boot-filter2	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-spring-boot-filter2	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Filter Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-spring-filter/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-spring-filter	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-spring-filter	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Form Demo for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-demo/waffle-demo-spring-form/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-demo-spring-form	Low
Vendor	project	groupid	com.github.waffle.demo	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-demo-spring-form	Highest
Product	project	groupid	com.github.waffle.demo	Low

Identifiers

pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Jetty Jakarta integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jetty-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-jetty-jakarta	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-jetty-jakarta	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)
cpe:2.3:a:jetty:jetty:3.6.1:snapshot:*:*:*:*:*:* (Confidence:Low)

Description:

Jetty integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jetty/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-jetty	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-jetty	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT (Confidence:Highest)
cpe:2.3:a:jetty:jetty:3.6.1:snapshot:*:*:*:*:*:* (Confidence:Low)

Description:

WAFFLE JNA Jakarta Pakage implementation

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna-jakarta/pom.xml

Referenced In Projects/Scopes:

waffle-demo-filter-jakarta
waffle-demo-form-jakarta
waffle-demo-jaas-jakarta
waffle-demo-mixed-jakarta
waffle-demo-mixed-post-jakarta
waffle-demo-negotiate-jakarta
waffle-demo-spring-boot-filter3
waffle-demo-spring-boot-filter4
waffle-demo-spring-filter-jakarta
waffle-demo-spring-form-jakarta
waffle-distro-jakarta
waffle-jetty-jakarta
waffle-shiro-jakarta
waffle-spring-boot-autoconfigure3
waffle-spring-boot-autoconfigure4
waffle-spring-boot-starter3
waffle-spring-boot-starter4
waffle-spring-security6
waffle-spring-security7
waffle-tests-jakarta
waffle-tomcat10
waffle-tomcat11

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat11@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-jna-jakarta	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-jna-jakarta	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

WAFFLE JNA implementation

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna/pom.xml

Referenced In Projects/Scopes:

waffle-demo-filter
waffle-demo-form
waffle-demo-jaas
waffle-demo-mixed
waffle-demo-mixed-post
waffle-demo-negotiate
waffle-demo-spring-boot-filter2
waffle-demo-spring-filter
waffle-demo-spring-form
waffle-distro
waffle-jetty
waffle-shiro
waffle-spring-boot-autoconfigure2
waffle-spring-boot-starter2
waffle-spring-security5
waffle-tests
waffle-tomcat9

pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-jna	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-jna	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Shiro Jakarta Integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-shiro-jakarta/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-shiro-jakarta	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-shiro-jakarta	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Shiro integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-shiro/pom.xml

Referenced In Project/Scope: waffle-distro
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-shiro	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-shiro	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot 2 Autoconfigure for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot2/waffle-spring-boot-autoconfigure2/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2
waffle-distro
waffle-spring-boot-starter2

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-boot-autoconfigure2	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-boot-autoconfigure2	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot 3 Autoconfigure for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot3/waffle-spring-boot-autoconfigure3/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3
waffle-distro-jakarta
waffle-spring-boot-starter3

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-boot-autoconfigure3	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-boot-autoconfigure3	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot 4 Autoconfigure for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot4/waffle-spring-boot-autoconfigure4/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4
waffle-distro-jakarta
waffle-spring-boot-starter4

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-boot-autoconfigure4	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-boot-autoconfigure4	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot 2 Starter for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot2/waffle-spring-boot-starter2/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2
waffle-distro

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-boot-starter2	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-boot-starter2	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot 3 Starter for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot3/waffle-spring-boot-starter3/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3
waffle-distro-jakarta

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-boot-starter3	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-boot-starter3	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Boot 4 Starter for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot4/waffle-spring-boot-starter4/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4
waffle-distro-jakarta

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-boot-starter4	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-boot-starter4	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Security 5 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-security5/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2
waffle-demo-spring-filter
waffle-demo-spring-form
waffle-distro
waffle-spring-boot-autoconfigure2
waffle-spring-boot-starter2

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-security5	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-security5	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Security 6 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-security6/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3
waffle-demo-spring-filter-jakarta
waffle-demo-spring-form-jakarta
waffle-distro-jakarta
waffle-spring-boot-autoconfigure3
waffle-spring-boot-starter3

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-security6	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-security6	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Spring Security 7 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-security7/pom.xml

Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4
waffle-distro-jakarta
waffle-spring-boot-autoconfigure4
waffle-spring-boot-starter4

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-spring-security7	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-spring-security7	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Tomcat 10 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-tomcat10/pom.xml

Referenced In Projects/Scopes:

waffle-demo-filter-jakarta
waffle-demo-mixed-jakarta
waffle-demo-mixed-post-jakarta
waffle-demo-negotiate-jakarta
waffle-distro-jakarta

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-tomcat10	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-tomcat10	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Tomcat 11 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-tomcat11/pom.xml

Referenced In Project/Scope: waffle-distro-jakarta
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-tomcat11	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-tomcat11	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-tomcat11@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Tomcat 9 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-tomcat9/pom.xml

Referenced In Projects/Scopes:

waffle-demo-filter
waffle-demo-mixed
waffle-demo-mixed-post
waffle-demo-negotiate
waffle-distro

pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-tomcat9	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-tomcat9	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT (Confidence:Highest)

Description:

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/commons-beanutils/commons-beanutils/1.11.0/commons-beanutils-1.11.0.jar
MD5: 32ed51f196dfda19e0dc1ce53eeed29e
SHA1: ac03ea606d13de04c2e4508227680faff151f491
SHA256:9e44ba68ec9a3f21286fa2a8bbb003b735c0f69101bb43144b79f4f8aaa74709
Referenced In Projects/Scopes:

waffle-shiro-jakarta:provided
waffle-shiro:provided

pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-beanutils	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	beanutils	Highest
Vendor	jar	package name	commons	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-beanutils	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-beanutils	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-beanutils	Highest
Vendor	pom	artifactid	commons-beanutils	Low
Vendor	pom	developer email	britter@apache.org	Low
Vendor	pom	developer email	chtompki@apache.org	Low
Vendor	pom	developer email	craigmcc@apache.org	Low
Vendor	pom	developer email	dion@apache.org	Low
Vendor	pom	developer email	epugh@apache.org	Low
Vendor	pom	developer email	geirm@apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jcarman@apache.org	Low
Vendor	pom	developer email	jconlon@apache.org	Low
Vendor	pom	developer email	jstrachan@apache.org	Low
Vendor	pom	developer email	morgand@apache.org	Low
Vendor	pom	developer email	mvdb@apache.org	Low
Vendor	pom	developer email	niallp@apache.org	Low
Vendor	pom	developer email	rdonkin@apache.org	Low
Vendor	pom	developer email	rwaldhoff@apache.org	Low
Vendor	pom	developer email	sanders@apache.org	Low
Vendor	pom	developer email	scolebourne@apache.org	Low
Vendor	pom	developer email	skitching@apache.org	Low
Vendor	pom	developer email	stain@apache.org	Low
Vendor	pom	developer email	tobrien@apache.org	Low
Vendor	pom	developer email	yoavs@apache.org	Low
Vendor	pom	developer id	britter	Medium
Vendor	pom	developer id	chtompki	Medium
Vendor	pom	developer id	craigmcc	Medium
Vendor	pom	developer id	dion	Medium
Vendor	pom	developer id	epugh	Medium
Vendor	pom	developer id	geirm	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jcarman	Medium
Vendor	pom	developer id	jconlon	Medium
Vendor	pom	developer id	jstrachan	Medium
Vendor	pom	developer id	morgand	Medium
Vendor	pom	developer id	mvdb	Medium
Vendor	pom	developer id	niallp	Medium
Vendor	pom	developer id	rdonkin	Medium
Vendor	pom	developer id	rwaldhoff	Medium
Vendor	pom	developer id	sanders	Medium
Vendor	pom	developer id	scolebourne	Medium
Vendor	pom	developer id	skitching	Medium
Vendor	pom	developer id	stain	Medium
Vendor	pom	developer id	tobrien	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Benedikt Ritter	Medium
Vendor	pom	developer name	Craig McClanahan	Medium
Vendor	pom	developer name	David Eric Pugh	Medium
Vendor	pom	developer name	Dion Gillard	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Geir Magnusson Jr.	Medium
Vendor	pom	developer name	James Carman	Medium
Vendor	pom	developer name	James Strachan	Medium
Vendor	pom	developer name	John E. Conlon	Medium
Vendor	pom	developer name	Martin van den Bemt	Medium
Vendor	pom	developer name	Morgan James Delagrange	Medium
Vendor	pom	developer name	Niall Pemberton	Medium
Vendor	pom	developer name	Rob Tompkins	Medium
Vendor	pom	developer name	Robert Burrell Donkin	Medium
Vendor	pom	developer name	Rodney Waldhoff	Medium
Vendor	pom	developer name	Scott Sanders	Medium
Vendor	pom	developer name	Simon Kitching	Medium
Vendor	pom	developer name	Stephen Colebourne	Medium
Vendor	pom	developer name	Stian Soiland-Reyes	Medium
Vendor	pom	developer name	Tim O'Brien	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-beanutils	Highest
Vendor	pom	name	Apache Commons BeanUtils	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-beanutils	Highest
Product	file	name	commons-beanutils	High
Product	jar	package name	apache	Highest
Product	jar	package name	beanutils	Highest
Product	jar	package name	commons	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-beanutils	Low
Product	Manifest	Bundle-Name	Apache Commons BeanUtils	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-beanutils	Medium
Product	Manifest	Implementation-Title	Apache Commons BeanUtils	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons BeanUtils	Medium
Product	pom	artifactid	commons-beanutils	Highest
Product	pom	developer email	britter@apache.org	Low
Product	pom	developer email	chtompki@apache.org	Low
Product	pom	developer email	craigmcc@apache.org	Low
Product	pom	developer email	dion@apache.org	Low
Product	pom	developer email	epugh@apache.org	Low
Product	pom	developer email	geirm@apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jcarman@apache.org	Low
Product	pom	developer email	jconlon@apache.org	Low
Product	pom	developer email	jstrachan@apache.org	Low
Product	pom	developer email	morgand@apache.org	Low
Product	pom	developer email	mvdb@apache.org	Low
Product	pom	developer email	niallp@apache.org	Low
Product	pom	developer email	rdonkin@apache.org	Low
Product	pom	developer email	rwaldhoff@apache.org	Low
Product	pom	developer email	sanders@apache.org	Low
Product	pom	developer email	scolebourne@apache.org	Low
Product	pom	developer email	skitching@apache.org	Low
Product	pom	developer email	stain@apache.org	Low
Product	pom	developer email	tobrien@apache.org	Low
Product	pom	developer email	yoavs@apache.org	Low
Product	pom	developer id	britter	Low
Product	pom	developer id	chtompki	Low
Product	pom	developer id	craigmcc	Low
Product	pom	developer id	dion	Low
Product	pom	developer id	epugh	Low
Product	pom	developer id	geirm	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jcarman	Low
Product	pom	developer id	jconlon	Low
Product	pom	developer id	jstrachan	Low
Product	pom	developer id	morgand	Low
Product	pom	developer id	mvdb	Low
Product	pom	developer id	niallp	Low
Product	pom	developer id	rdonkin	Low
Product	pom	developer id	rwaldhoff	Low
Product	pom	developer id	sanders	Low
Product	pom	developer id	scolebourne	Low
Product	pom	developer id	skitching	Low
Product	pom	developer id	stain	Low
Product	pom	developer id	tobrien	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Benedikt Ritter	Low
Product	pom	developer name	Craig McClanahan	Low
Product	pom	developer name	David Eric Pugh	Low
Product	pom	developer name	Dion Gillard	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Geir Magnusson Jr.	Low
Product	pom	developer name	James Carman	Low
Product	pom	developer name	James Strachan	Low
Product	pom	developer name	John E. Conlon	Low
Product	pom	developer name	Martin van den Bemt	Low
Product	pom	developer name	Morgan James Delagrange	Low
Product	pom	developer name	Niall Pemberton	Low
Product	pom	developer name	Rob Tompkins	Low
Product	pom	developer name	Robert Burrell Donkin	Low
Product	pom	developer name	Rodney Waldhoff	Low
Product	pom	developer name	Scott Sanders	Low
Product	pom	developer name	Simon Kitching	Low
Product	pom	developer name	Stephen Colebourne	Low
Product	pom	developer name	Stian Soiland-Reyes	Low
Product	pom	developer name	Tim O'Brien	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-beanutils	Highest
Product	pom	name	Apache Commons BeanUtils	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-beanutils	Medium
Version	file	version	1.11.0	High
Version	Manifest	Bundle-Version	1.11.0	High
Version	Manifest	Implementation-Version	1.11.0	High
Version	pom	parent-version	1.11.0	Low
Version	pom	version	1.11.0	Highest

Identifiers

pkg:maven/commons-beanutils/commons-beanutils@1.11.0 (Confidence:High)
cpe:2.3:a:apache:commons_beanutils:1.11.0:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.3.5/commons-logging-1.3.5.jar
MD5: 9ca067b073153c86c2da350c0f2cdf70
SHA1: a3fcc5d3c29b2b03433aa2d2f2d2c1b1638924a1
SHA256:6d7a744e4027649fbb50895df9497d109f98c766a637062fe8d2eabbb3140ba4
Referenced In Projects/Scopes:

waffle-shiro-jakarta:provided
waffle-shiro:provided

pkg:maven/commons-beanutils/commons-beanutils@1.11.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-logging	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-logging	Highest
Vendor	pom	artifactid	commons-logging	Low
Vendor	pom	developer email	baliuka@apache.org	Low
Vendor	pom	developer email	costin@apache.org	Low
Vendor	pom	developer email	craigmcc@apache.org	Low
Vendor	pom	developer email	dennisl@apache.org	Low
Vendor	pom	developer email	donaldp@apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	morgand@apache.org	Low
Vendor	pom	developer email	rdonkin@apache.org	Low
Vendor	pom	developer email	rsitze@apache.org	Low
Vendor	pom	developer email	rwaldhoff@apache.org	Low
Vendor	pom	developer email	sanders@apache.org	Low
Vendor	pom	developer email	skitching@apache.org	Low
Vendor	pom	developer email	tn@apache.org	Low
Vendor	pom	developer id	baliuka	Medium
Vendor	pom	developer id	bstansberry	Medium
Vendor	pom	developer id	costin	Medium
Vendor	pom	developer id	craigmcc	Medium
Vendor	pom	developer id	dennisl	Medium
Vendor	pom	developer id	donaldp	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	morgand	Medium
Vendor	pom	developer id	rdonkin	Medium
Vendor	pom	developer id	rsitze	Medium
Vendor	pom	developer id	rwaldhoff	Medium
Vendor	pom	developer id	sanders	Medium
Vendor	pom	developer id	skitching	Medium
Vendor	pom	developer id	tn	Medium
Vendor	pom	developer name	Brian Stansberry	Medium
Vendor	pom	developer name	Costin Manolache	Medium
Vendor	pom	developer name	Craig McClanahan	Medium
Vendor	pom	developer name	Dennis Lundberg	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Juozas Baliuka	Medium
Vendor	pom	developer name	Morgan Delagrange	Medium
Vendor	pom	developer name	Peter Donald	Medium
Vendor	pom	developer name	Richard Sitze	Medium
Vendor	pom	developer name	Robert Burrell Donkin	Medium
Vendor	pom	developer name	Rodney Waldhoff	Medium
Vendor	pom	developer name	Scott Sanders	Medium
Vendor	pom	developer name	Simon Kitching	Medium
Vendor	pom	developer name	Thomas Neidhart	Medium
Vendor	pom	developer org	Apache	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-logging	Highest
Vendor	pom	name	Apache Commons Logging	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-logging/	Highest
Product	file	name	commons-logging	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	logging	Highest
Product	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Product	Manifest	Bundle-Name	Apache Commons Logging	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Product	Manifest	Implementation-Title	Apache Commons Logging	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Logging	Medium
Product	pom	artifactid	commons-logging	Highest
Product	pom	developer email	baliuka@apache.org	Low
Product	pom	developer email	costin@apache.org	Low
Product	pom	developer email	craigmcc@apache.org	Low
Product	pom	developer email	dennisl@apache.org	Low
Product	pom	developer email	donaldp@apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	morgand@apache.org	Low
Product	pom	developer email	rdonkin@apache.org	Low
Product	pom	developer email	rsitze@apache.org	Low
Product	pom	developer email	rwaldhoff@apache.org	Low
Product	pom	developer email	sanders@apache.org	Low
Product	pom	developer email	skitching@apache.org	Low
Product	pom	developer email	tn@apache.org	Low
Product	pom	developer id	baliuka	Low
Product	pom	developer id	bstansberry	Low
Product	pom	developer id	costin	Low
Product	pom	developer id	craigmcc	Low
Product	pom	developer id	dennisl	Low
Product	pom	developer id	donaldp	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	morgand	Low
Product	pom	developer id	rdonkin	Low
Product	pom	developer id	rsitze	Low
Product	pom	developer id	rwaldhoff	Low
Product	pom	developer id	sanders	Low
Product	pom	developer id	skitching	Low
Product	pom	developer id	tn	Low
Product	pom	developer name	Brian Stansberry	Low
Product	pom	developer name	Costin Manolache	Low
Product	pom	developer name	Craig McClanahan	Low
Product	pom	developer name	Dennis Lundberg	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Juozas Baliuka	Low
Product	pom	developer name	Morgan Delagrange	Low
Product	pom	developer name	Peter Donald	Low
Product	pom	developer name	Richard Sitze	Low
Product	pom	developer name	Robert Burrell Donkin	Low
Product	pom	developer name	Rodney Waldhoff	Low
Product	pom	developer name	Scott Sanders	Low
Product	pom	developer name	Simon Kitching	Low
Product	pom	developer name	Thomas Neidhart	Low
Product	pom	developer org	Apache	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-logging	Highest
Product	pom	name	Apache Commons Logging	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-logging/	Medium
Version	file	version	1.3.5	High
Version	Manifest	Bundle-Version	1.3.5	High
Version	Manifest	Implementation-Version	1.3.5	High
Version	pom	parent-version	1.3.5	Low
Version	pom	version	1.3.5	Highest

Identifiers

pkg:maven/commons-logging/commons-logging@1.3.5 (Confidence:High)

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.3.6/commons-logging-1.3.6.jar
MD5: fe0ccbe8971fed954a0ad6528fe3ef24
SHA1: 63e78ca6cd446c0ad166d14f03ed99e7efb3896d
SHA256:f8ead8943401081dea0aa824b5b1ba40a0e4ed297a572a0f02258150a0b62357
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-starter4:compile

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-logging	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-logging	Highest
Vendor	pom	artifactid	commons-logging	Low
Vendor	pom	developer email	baliuka@apache.org	Low
Vendor	pom	developer email	costin@apache.org	Low
Vendor	pom	developer email	craigmcc@apache.org	Low
Vendor	pom	developer email	dennisl@apache.org	Low
Vendor	pom	developer email	donaldp@apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	morgand@apache.org	Low
Vendor	pom	developer email	rdonkin@apache.org	Low
Vendor	pom	developer email	rsitze@apache.org	Low
Vendor	pom	developer email	rwaldhoff@apache.org	Low
Vendor	pom	developer email	sanders@apache.org	Low
Vendor	pom	developer email	skitching@apache.org	Low
Vendor	pom	developer email	tn@apache.org	Low
Vendor	pom	developer id	baliuka	Medium
Vendor	pom	developer id	bstansberry	Medium
Vendor	pom	developer id	costin	Medium
Vendor	pom	developer id	craigmcc	Medium
Vendor	pom	developer id	dennisl	Medium
Vendor	pom	developer id	donaldp	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	morgand	Medium
Vendor	pom	developer id	rdonkin	Medium
Vendor	pom	developer id	rsitze	Medium
Vendor	pom	developer id	rwaldhoff	Medium
Vendor	pom	developer id	sanders	Medium
Vendor	pom	developer id	skitching	Medium
Vendor	pom	developer id	tn	Medium
Vendor	pom	developer name	Brian Stansberry	Medium
Vendor	pom	developer name	Costin Manolache	Medium
Vendor	pom	developer name	Craig McClanahan	Medium
Vendor	pom	developer name	Dennis Lundberg	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Juozas Baliuka	Medium
Vendor	pom	developer name	Morgan Delagrange	Medium
Vendor	pom	developer name	Peter Donald	Medium
Vendor	pom	developer name	Richard Sitze	Medium
Vendor	pom	developer name	Robert Burrell Donkin	Medium
Vendor	pom	developer name	Rodney Waldhoff	Medium
Vendor	pom	developer name	Scott Sanders	Medium
Vendor	pom	developer name	Simon Kitching	Medium
Vendor	pom	developer name	Thomas Neidhart	Medium
Vendor	pom	developer org	Apache	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-logging	Highest
Vendor	pom	name	Apache Commons Logging	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-logging/	Highest
Product	file	name	commons-logging	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	logging	Highest
Product	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Product	Manifest	Bundle-Name	Apache Commons Logging	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Product	Manifest	Implementation-Title	Apache Commons Logging	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Logging	Medium
Product	pom	artifactid	commons-logging	Highest
Product	pom	developer email	baliuka@apache.org	Low
Product	pom	developer email	costin@apache.org	Low
Product	pom	developer email	craigmcc@apache.org	Low
Product	pom	developer email	dennisl@apache.org	Low
Product	pom	developer email	donaldp@apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	morgand@apache.org	Low
Product	pom	developer email	rdonkin@apache.org	Low
Product	pom	developer email	rsitze@apache.org	Low
Product	pom	developer email	rwaldhoff@apache.org	Low
Product	pom	developer email	sanders@apache.org	Low
Product	pom	developer email	skitching@apache.org	Low
Product	pom	developer email	tn@apache.org	Low
Product	pom	developer id	baliuka	Low
Product	pom	developer id	bstansberry	Low
Product	pom	developer id	costin	Low
Product	pom	developer id	craigmcc	Low
Product	pom	developer id	dennisl	Low
Product	pom	developer id	donaldp	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	morgand	Low
Product	pom	developer id	rdonkin	Low
Product	pom	developer id	rsitze	Low
Product	pom	developer id	rwaldhoff	Low
Product	pom	developer id	sanders	Low
Product	pom	developer id	skitching	Low
Product	pom	developer id	tn	Low
Product	pom	developer name	Brian Stansberry	Low
Product	pom	developer name	Costin Manolache	Low
Product	pom	developer name	Craig McClanahan	Low
Product	pom	developer name	Dennis Lundberg	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Juozas Baliuka	Low
Product	pom	developer name	Morgan Delagrange	Low
Product	pom	developer name	Peter Donald	Low
Product	pom	developer name	Richard Sitze	Low
Product	pom	developer name	Robert Burrell Donkin	Low
Product	pom	developer name	Rodney Waldhoff	Low
Product	pom	developer name	Scott Sanders	Low
Product	pom	developer name	Simon Kitching	Low
Product	pom	developer name	Thomas Neidhart	Low
Product	pom	developer org	Apache	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-logging	Highest
Product	pom	name	Apache Commons Logging	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-logging/	Medium
Version	file	version	1.3.6	High
Version	Manifest	Bundle-Version	1.3.6	High
Version	Manifest	Implementation-Version	1.3.6	High
Version	pom	parent-version	1.3.6	Low
Version	pom	version	1.3.6	Highest

Identifiers

pkg:maven/commons-logging/commons-logging@1.3.6 (Confidence:High)

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.4.0/commons-logging-1.4.0.jar
MD5: 954e27d33e55e587a4694d5952a0c5c6
SHA1: e8f6313365dfa0580e49c58837afc8caa9b4ce05
SHA256:d175dbd751dd782a63bde28c7a039520e971f25e84b79c19b8435edc3603e0dc
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-logging	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-logging	Highest
Vendor	pom	artifactid	commons-logging	Low
Vendor	pom	developer email	baliuka@apache.org	Low
Vendor	pom	developer email	costin@apache.org	Low
Vendor	pom	developer email	craigmcc@apache.org	Low
Vendor	pom	developer email	dennisl@apache.org	Low
Vendor	pom	developer email	donaldp@apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	morgand@apache.org	Low
Vendor	pom	developer email	rdonkin@apache.org	Low
Vendor	pom	developer email	rsitze@apache.org	Low
Vendor	pom	developer email	rwaldhoff@apache.org	Low
Vendor	pom	developer email	sanders@apache.org	Low
Vendor	pom	developer email	skitching@apache.org	Low
Vendor	pom	developer email	tn@apache.org	Low
Vendor	pom	developer id	baliuka	Medium
Vendor	pom	developer id	bstansberry	Medium
Vendor	pom	developer id	costin	Medium
Vendor	pom	developer id	craigmcc	Medium
Vendor	pom	developer id	dennisl	Medium
Vendor	pom	developer id	donaldp	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	morgand	Medium
Vendor	pom	developer id	rdonkin	Medium
Vendor	pom	developer id	rsitze	Medium
Vendor	pom	developer id	rwaldhoff	Medium
Vendor	pom	developer id	sanders	Medium
Vendor	pom	developer id	skitching	Medium
Vendor	pom	developer id	tn	Medium
Vendor	pom	developer name	Brian Stansberry	Medium
Vendor	pom	developer name	Costin Manolache	Medium
Vendor	pom	developer name	Craig McClanahan	Medium
Vendor	pom	developer name	Dennis Lundberg	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Juozas Baliuka	Medium
Vendor	pom	developer name	Morgan Delagrange	Medium
Vendor	pom	developer name	Peter Donald	Medium
Vendor	pom	developer name	Richard Sitze	Medium
Vendor	pom	developer name	Robert Burrell Donkin	Medium
Vendor	pom	developer name	Rodney Waldhoff	Medium
Vendor	pom	developer name	Scott Sanders	Medium
Vendor	pom	developer name	Simon Kitching	Medium
Vendor	pom	developer name	Thomas Neidhart	Medium
Vendor	pom	developer org	Apache	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-logging	Highest
Vendor	pom	name	Apache Commons Logging	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-logging/	Highest
Product	file	name	commons-logging	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	logging	Highest
Product	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Product	Manifest	Bundle-Name	Apache Commons Logging	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Product	Manifest	Implementation-Title	Apache Commons Logging	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Logging	Medium
Product	pom	artifactid	commons-logging	Highest
Product	pom	developer email	baliuka@apache.org	Low
Product	pom	developer email	costin@apache.org	Low
Product	pom	developer email	craigmcc@apache.org	Low
Product	pom	developer email	dennisl@apache.org	Low
Product	pom	developer email	donaldp@apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	morgand@apache.org	Low
Product	pom	developer email	rdonkin@apache.org	Low
Product	pom	developer email	rsitze@apache.org	Low
Product	pom	developer email	rwaldhoff@apache.org	Low
Product	pom	developer email	sanders@apache.org	Low
Product	pom	developer email	skitching@apache.org	Low
Product	pom	developer email	tn@apache.org	Low
Product	pom	developer id	baliuka	Low
Product	pom	developer id	bstansberry	Low
Product	pom	developer id	costin	Low
Product	pom	developer id	craigmcc	Low
Product	pom	developer id	dennisl	Low
Product	pom	developer id	donaldp	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	morgand	Low
Product	pom	developer id	rdonkin	Low
Product	pom	developer id	rsitze	Low
Product	pom	developer id	rwaldhoff	Low
Product	pom	developer id	sanders	Low
Product	pom	developer id	skitching	Low
Product	pom	developer id	tn	Low
Product	pom	developer name	Brian Stansberry	Low
Product	pom	developer name	Costin Manolache	Low
Product	pom	developer name	Craig McClanahan	Low
Product	pom	developer name	Dennis Lundberg	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Juozas Baliuka	Low
Product	pom	developer name	Morgan Delagrange	Low
Product	pom	developer name	Peter Donald	Low
Product	pom	developer name	Richard Sitze	Low
Product	pom	developer name	Robert Burrell Donkin	Low
Product	pom	developer name	Rodney Waldhoff	Low
Product	pom	developer name	Scott Sanders	Low
Product	pom	developer name	Simon Kitching	Low
Product	pom	developer name	Thomas Neidhart	Low
Product	pom	developer org	Apache	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-logging	Highest
Product	pom	name	Apache Commons Logging	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-logging/	Medium
Version	file	version	1.4.0	High
Version	Manifest	Bundle-Version	1.4.0	High
Version	Manifest	Implementation-Version	1.4.0	High
Version	pom	parent-version	1.4.0	Low
Version	pom	version	1.4.0	Highest

Identifiers

pkg:maven/commons-logging/commons-logging@1.4.0 (Confidence:High)

Description:

Eclipse Compiler for Java(TM)

License:

EPL-2.0: https://www.eclipse.org/legal/epl-2.0/

File Path: /home/runner/.m2/repository/org/eclipse/jdt/ecj/3.46.100/ecj-3.46.100.jar
MD5: 56b7091e6cf1fb7af9429e3fd7a89858
SHA1: a06c482cdb8601a94328aae668c7236e3818fbe9
SHA256:74c93172475fee0cd4e6eefb44233516dd40525642da35d009146d97ea598229
Referenced In Projects/Scopes:

waffle-jetty-jakarta:provided
waffle-jetty:provided

pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ecj	High
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	jdt	Highest
Vendor	Manifest	automatic-module-name	org.eclipse.jdt.core.compiler.batch	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-activationpolicy	lazy	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-17	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Vendor	pom	artifactid	ecj	Highest
Vendor	pom	artifactid	ecj	Low
Vendor	pom	groupid	org.eclipse.jdt	Highest
Vendor	pom	name	Eclipse Compiler for Java(TM)	High
Vendor	pom	organization name	Eclipse Foundation	High
Vendor	pom	organization url	https://www.eclipse.org	Medium
Vendor	pom	url	eclipse-jdt/eclipse.jdt.core/	Highest
Product	file	name	ecj	High
Product	jar	package name	compiler	Highest
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	jdt	Highest
Product	Manifest	automatic-module-name	org.eclipse.jdt.core.compiler.batch	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-activationpolicy	lazy	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-17	Low
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	pom	artifactid	ecj	Highest
Product	pom	groupid	org.eclipse.jdt	Highest
Product	pom	name	Eclipse Compiler for Java(TM)	High
Product	pom	organization name	Eclipse Foundation	Low
Product	pom	organization url	https://www.eclipse.org	Low
Product	pom	url	eclipse-jdt/eclipse.jdt.core/	High
Version	file	version	3.46.100	High
Version	pom	version	3.46.100	Highest

Identifiers

pkg:maven/org.eclipse.jdt/ecj@3.46.100 (Confidence:High)

Description:

        The OWASP Encoders package is a collection of high-performance low-overhead
        contextual encoders, that when utilized correctly, is an effective tool in
        preventing Web Application security vulnerabilities such as Cross-Site
        Scripting.

License:

http://www.opensource.org/licenses/BSD-3-Clause

File Path: /home/runner/.m2/repository/org/owasp/encoder/encoder/1.4.0/encoder-1.4.0.jar
MD5: d26a36885af1fd62e8a3c18ec51ed39c
SHA1: 41560c4db1cae2290402eee6ea0db544e8d48b7f
SHA256:90f9860925905dd97f313cffae065835eb02acc3e2e9b0051621693efd09025c
Referenced In Projects/Scopes:

waffle-shiro-jakarta:provided
waffle-shiro:provided

pkg:maven/org.apache.shiro/shiro-web@2.2.1
pkg:maven/org.apache.shiro/shiro-web@3.0.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	encoder	High
Vendor	jar	package name	encoder	Highest
Vendor	jar	package name	encoders	Highest
Vendor	jar	package name	owasp	Highest
Vendor	Manifest	automatic-module-name	org.owasp.encoder	Medium
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://www.owasp.org/	Low
Vendor	Manifest	bundle-symbolicname	org.owasp.encoder	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin	Low
Vendor	pom	artifactid	encoder	Highest
Vendor	pom	artifactid	encoder	Low
Vendor	pom	groupid	org.owasp.encoder	Highest
Vendor	pom	name	Java Encoder	High
Vendor	pom	parent-artifactid	encoder-parent	Low
Product	file	name	encoder	High
Product	jar	package name	encoder	Highest
Product	jar	package name	encoders	Highest
Product	jar	package name	owasp	Highest
Product	Manifest	automatic-module-name	org.owasp.encoder	Medium
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://www.owasp.org/	Low
Product	Manifest	Bundle-Name	Java Encoder	Medium
Product	Manifest	bundle-symbolicname	org.owasp.encoder	Medium
Product	Manifest	multi-release	true	Low
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin	Low
Product	pom	artifactid	encoder	Highest
Product	pom	groupid	org.owasp.encoder	Highest
Product	pom	name	Java Encoder	High
Product	pom	parent-artifactid	encoder-parent	Medium
Version	file	version	1.4.0	High
Version	Manifest	Bundle-Version	1.4.0	High
Version	pom	version	1.4.0	Highest

Identifiers

pkg:maven/org.owasp.encoder/encoder@1.4.0 (Confidence:High)

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.50.0/error_prone_annotations-2.50.0.jar
MD5: 1ded1848cfd4f5167e00824faf9c4d3b
SHA1: 74ba43e49ab1184d41634af2ef0047e82c4064b0
SHA256:4667724877f1d37a689202da191e23efa7657c62eef93ccdac406eccfe5cdd0a
Referenced In Projects/Scopes:

waffle-bom-jakarta:provided
waffle-bom:provided
waffle-demo-filter-jakarta:provided
waffle-demo-filter:provided
waffle-demo-form-jakarta:provided
waffle-demo-form:provided
waffle-demo-jaas-jakarta:provided
waffle-demo-jaas:provided
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-parent-jakarta:provided
waffle-demo-parent:provided
waffle-demo-spring-boot-filter2:provided
waffle-demo-spring-boot-filter3:provided
waffle-demo-spring-boot-filter4:provided
waffle-demo-spring-filter-jakarta:provided
waffle-demo-spring-filter:provided
waffle-demo-spring-form-jakarta:provided
waffle-demo-spring-form:provided
waffle-distro-jakarta:provided
waffle-distro:provided
waffle-jetty-jakarta:provided
waffle-jetty:provided
waffle-jna-jakarta:provided
waffle-jna:provided
waffle-shiro-jakarta:provided
waffle-shiro:provided
waffle-spring-boot-autoconfigure2:provided
waffle-spring-boot-autoconfigure3:provided
waffle-spring-boot-autoconfigure4:provided
waffle-spring-boot-starter2:provided
waffle-spring-boot-starter3:provided
waffle-spring-boot-starter4:provided
waffle-spring-boot2:provided
waffle-spring-boot3:provided
waffle-spring-boot4:provided
waffle-spring-security5:provided
waffle-spring-security6:provided
waffle-spring-security7:provided
waffle-tests-jakarta:provided
waffle-tests:provided
waffle-tomcat10:provided
waffle-tomcat11:provided
waffle-tomcat9:provided
waffle:provided

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-parent-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-parent@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat11@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.50.0	High
Version	Manifest	Bundle-Version	2.50.0	High
Version	pom	version	2.50.0	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0 (Confidence:High)

Description:

Jakarta Expression Language Implementation

License:

https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt, https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/org/glassfish/expressly/expressly/6.0.0/expressly-6.0.0.jar
MD5: e19bad48904a955072a576f0efea554b
SHA1: 0524fa43fa48fc68fb62604cf14ce71b31caf7c0
SHA256:86ee67c7040278bac5204b571f738b8b859f014ceb5f896bd935bacbdaf33cb9
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	expressly	High
Vendor	jar	package name	expressly	Highest
Vendor	jar	package name	glassfish	Highest
Vendor	Manifest	automatic-module-name	org.glassfish.expressly	Medium
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	org.glassfish.expressly	Medium
Vendor	Manifest	extension-name	org.glassfish.expressly	Medium
Vendor	Manifest	Implementation-Vendor	${vendorName}	High
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	expressly	Highest
Vendor	pom	artifactid	expressly	Low
Vendor	pom	developer email	expressly-dev@eclipse.org	Low
Vendor	pom	developer id	jakarta-ee4j-expressly	Medium
Vendor	pom	developer name	Eclipse Expressly Developers	Medium
Vendor	pom	developer org	Eclipse Foundation	Medium
Vendor	pom	groupid	org.glassfish.expressly	Highest
Vendor	pom	name	Eclipse Expressly	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.expressly	Highest
Product	file	name	expressly	High
Product	jar	package name	expressly	Highest
Product	jar	package name	glassfish	Highest
Product	Manifest	automatic-module-name	org.glassfish.expressly	Medium
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Eclipse Expressly	Medium
Product	Manifest	bundle-symbolicname	org.glassfish.expressly	Medium
Product	Manifest	extension-name	org.glassfish.expressly	Medium
Product	pom	artifactid	expressly	Highest
Product	pom	developer email	expressly-dev@eclipse.org	Low
Product	pom	developer id	jakarta-ee4j-expressly	Low
Product	pom	developer name	Eclipse Expressly Developers	Low
Product	pom	developer org	Eclipse Foundation	Low
Product	pom	groupid	org.glassfish.expressly	Highest
Product	pom	name	Eclipse Expressly	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.expressly	Medium
Version	file	version	6.0.0	High
Version	Manifest	Bundle-Version	6.0.0	High
Version	Manifest	Implementation-Version	6.0.0	High
Version	pom	parent-version	6.0.0	Low
Version	pom	version	6.0.0	Highest

Identifiers

pkg:maven/org.glassfish.expressly/expressly@6.0.0 (Confidence:High)

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.1/j2objc-annotations-3.1.jar
MD5: abe8bd3abff622b9a8b15c3a737aa741
SHA1: a892ca9507839bbdb900d64310ac98256cab992f
SHA256:84d3a150518485f8140ea99b8a985656749629f6433c92b80c75b36aba3b099b
Referenced In Projects/Scopes:

waffle-bom-jakarta:provided
waffle-bom:provided
waffle-demo-filter-jakarta:provided
waffle-demo-filter:provided
waffle-demo-form-jakarta:provided
waffle-demo-form:provided
waffle-demo-jaas-jakarta:provided
waffle-demo-jaas:provided
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-parent-jakarta:provided
waffle-demo-parent:provided
waffle-demo-spring-boot-filter2:provided
waffle-demo-spring-boot-filter3:provided
waffle-demo-spring-boot-filter4:provided
waffle-demo-spring-filter-jakarta:provided
waffle-demo-spring-filter:provided
waffle-demo-spring-form-jakarta:provided
waffle-demo-spring-form:provided
waffle-distro-jakarta:provided
waffle-distro:provided
waffle-jetty-jakarta:provided
waffle-jetty:provided
waffle-jna-jakarta:provided
waffle-jna:provided
waffle-shiro-jakarta:provided
waffle-shiro:provided
waffle-spring-boot-autoconfigure2:provided
waffle-spring-boot-autoconfigure3:provided
waffle-spring-boot-autoconfigure4:provided
waffle-spring-boot-starter2:provided
waffle-spring-boot-starter3:provided
waffle-spring-boot-starter4:provided
waffle-spring-boot2:provided
waffle-spring-boot3:provided
waffle-spring-boot4:provided
waffle-spring-security5:provided
waffle-spring-security6:provided
waffle-spring-security7:provided
waffle-tests-jakarta:provided
waffle-tests:provided
waffle-tomcat10:provided
waffle-tomcat11:provided
waffle-tomcat9:provided
waffle:provided

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-parent-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-parent@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat11@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	22	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	22	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.1	High
Version	pom	version	3.1	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.1 (Confidence:High)

Description:

Core annotations used for value types, used by Jackson data binding package.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.21/jackson-annotations-2.21.jar
MD5: e0d0c3e7300954f73e43c67d933aaea4
SHA1: b1bc1868bf02dc0bd6c7836257a036a331005309
SHA256:53ca085f4a150f703f49e1aabd935bd03b43e1ea3d55d135438292af22cef56b
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-annotations	High
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-annotations	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.core	Medium
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-annotations	Highest
Vendor	pom	artifactid	jackson-annotations	Low
Vendor	pom	groupid	com.fasterxml.jackson.core	Highest
Vendor	pom	name	Jackson-annotations	High
Vendor	pom	parent-artifactid	jackson-parent	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson	Medium
Vendor	pom	url	FasterXML/jackson	Highest
Product	file	name	jackson-annotations	High
Product	hint analyzer	product	java8	Highest
Product	hint analyzer	product	modules	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Product	Manifest	Bundle-Name	Jackson-annotations	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-annotations	Medium
Product	Manifest	Implementation-Title	Jackson-annotations	High
Product	Manifest	specification-title	Jackson-annotations	Medium
Product	pom	artifactid	jackson-annotations	Highest
Product	pom	groupid	com.fasterxml.jackson.core	Highest
Product	pom	name	Jackson-annotations	High
Product	pom	parent-artifactid	jackson-parent	Medium
Product	pom	parent-groupid	com.fasterxml.jackson	Medium
Product	pom	url	FasterXML/jackson	High
Version	file	version	2.21	High
Version	Manifest	Implementation-Version	2.21	High
Version	pom	version	2.21	Highest

Identifiers

pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:2.21:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21:*:*:*:*:*:*:* (Confidence:Low)

Description:

Core annotations used for value types, used by Jackson data binding package.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar
MD5: 04c11c456fd1e21b9a21c25c665109cc
SHA1: 15c67f9498d6934cff9510fc70c5a12e52290457
SHA256:21ddb598807d3a51a876704eb979d9296e1c6a6f47ab1826ff88c6d6a127a2d0
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-annotations	High
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-annotations	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.core	Medium
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-annotations	Highest
Vendor	pom	artifactid	jackson-annotations	Low
Vendor	pom	groupid	com.fasterxml.jackson.core	Highest
Vendor	pom	name	Jackson-annotations	High
Vendor	pom	parent-artifactid	jackson-parent	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson	Medium
Vendor	pom	url	FasterXML/jackson	Highest
Product	file	name	jackson-annotations	High
Product	hint analyzer	product	java8	Highest
Product	hint analyzer	product	modules	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Product	Manifest	Bundle-Name	Jackson-annotations	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-annotations	Medium
Product	Manifest	Implementation-Title	Jackson-annotations	High
Product	Manifest	specification-title	Jackson-annotations	Medium
Product	pom	artifactid	jackson-annotations	Highest
Product	pom	groupid	com.fasterxml.jackson.core	Highest
Product	pom	name	Jackson-annotations	High
Product	pom	parent-artifactid	jackson-parent	Medium
Product	pom	parent-groupid	com.fasterxml.jackson	Medium
Product	pom	url	FasterXML/jackson	High
Version	file	version	2.22	High
Version	Manifest	Implementation-Version	2.22	High
Version	pom	version	2.22	Highest

Identifiers

pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.22 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:2.22:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.22:*:*:*:*:*:*:* (Confidence:Low)

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.21.4/jackson-core-2.21.4.jar
MD5: 2f3d2557bb48afa00fe924c9689ab3b6
SHA1: 56a503ba45016714394807ea89f95f5093760089
SHA256:4b40a06396f239f8de2da57419adde6e94e5edc18a2171d471ea05eeed4e5c2d
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-core	High
Vendor	jar	package name	base	Highest
Vendor	jar	package name	com	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	jar	package name	json	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-core	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-core	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-core	Highest
Vendor	pom	artifactid	jackson-core	Low
Vendor	pom	groupid	com.fasterxml.jackson.core	Highest
Vendor	pom	name	Jackson-core	High
Vendor	pom	parent-artifactid	jackson-base	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson	Medium
Vendor	pom	url	FasterXML/jackson-core	Highest
Product	file	name	jackson-core	High
Product	hint analyzer	product	java8	Highest
Product	hint analyzer	product	modules	Highest
Product	jar	package name	base	Highest
Product	jar	package name	com	Highest
Product	jar	package name	core	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	jar	package name	json	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-core	Low
Product	Manifest	Bundle-Name	Jackson-core	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-core	Medium
Product	Manifest	Implementation-Title	Jackson-core	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Jackson-core	Medium
Product	pom	artifactid	jackson-core	Highest
Product	pom	groupid	com.fasterxml.jackson.core	Highest
Product	pom	name	Jackson-core	High
Product	pom	parent-artifactid	jackson-base	Medium
Product	pom	parent-groupid	com.fasterxml.jackson	Medium
Product	pom	url	FasterXML/jackson-core	High
Version	file	version	2.21.4	High
Version	Manifest	Bundle-Version	2.21.4	High
Version	Manifest	Implementation-Version	2.21.4	High
Version	pom	version	2.21.4	Highest

Identifiers

pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:2.21.4:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:* (Confidence:Low)

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.22.2/jackson-core-2.22.2.jar
MD5: f341c2ed9f8d995ac068841925cf34d1
SHA1: 13a748ea3e329fa220076e021b45c8391b32420c
SHA256:ff167a6317be15895706c26668f45b898efe40ab8780970658210fe1393d52a6
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-core	High
Vendor	jar	package name	base	Highest
Vendor	jar	package name	com	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	jar	package name	json	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-core	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-core	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-core	Highest
Vendor	pom	artifactid	jackson-core	Low
Vendor	pom	groupid	com.fasterxml.jackson.core	Highest
Vendor	pom	name	Jackson-core	High
Vendor	pom	parent-artifactid	jackson-base	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson	Medium
Vendor	pom	url	FasterXML/jackson-core	Highest
Product	file	name	jackson-core	High
Product	hint analyzer	product	java8	Highest
Product	hint analyzer	product	modules	Highest
Product	jar	package name	base	Highest
Product	jar	package name	com	Highest
Product	jar	package name	core	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	jar	package name	json	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-core	Low
Product	Manifest	Bundle-Name	Jackson-core	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-core	Medium
Product	Manifest	Implementation-Title	Jackson-core	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Jackson-core	Medium
Product	pom	artifactid	jackson-core	Highest
Product	pom	groupid	com.fasterxml.jackson.core	Highest
Product	pom	name	Jackson-core	High
Product	pom	parent-artifactid	jackson-base	Medium
Product	pom	parent-groupid	com.fasterxml.jackson	Medium
Product	pom	url	FasterXML/jackson-core	High
Version	file	version	2.22.2	High
Version	Manifest	Bundle-Version	2.22.2	High
Version	Manifest	Implementation-Version	2.22.2	High
Version	pom	version	2.22.2	Highest

Identifiers

pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.2 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:2.22.2:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.22.2:*:*:*:*:*:*:* (Confidence:Low)

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/tools/jackson/core/jackson-core/3.1.5/jackson-core-3.1.5.jar
MD5: ed1c26680ceec80183239a74ef15a838
SHA1: ccd7eb3269b8d33bc097b36770f367cdfe2f1150
SHA256:9431b7fa2673bbb618c11d865fe15e13222fd182a214ff998cb7e56afd8f35d2
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-core	High
Vendor	jar	package name	base	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	jackson	Highest
Vendor	jar	package name	json	Highest
Vendor	jar	package name	tools	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-core	Low
Vendor	Manifest	bundle-symbolicname	tools.jackson.core.jackson-core	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	tools.jackson.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-core	Highest
Vendor	pom	artifactid	jackson-core	Low
Vendor	pom	developer email	tatu@fasterxml.com	Low
Vendor	pom	developer id	cowtowncoder	Medium
Vendor	pom	developer name	Tatu Saloranta	Medium
Vendor	pom	groupid	tools.jackson.core	Highest
Vendor	pom	name	Jackson-core	High
Vendor	pom	parent-artifactid	jackson-base	Low
Vendor	pom	parent-groupid	tools.jackson	Medium
Vendor	pom	url	FasterXML/jackson-core	Highest
Product	file	name	jackson-core	High
Product	jar	package name	21	Highest
Product	jar	package name	base	Highest
Product	jar	package name	core	Highest
Product	jar	package name	jackson	Highest
Product	jar	package name	json	Highest
Product	jar	package name	tools	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-core	Low
Product	Manifest	Bundle-Name	Jackson-core	Medium
Product	Manifest	bundle-symbolicname	tools.jackson.core.jackson-core	Medium
Product	Manifest	Implementation-Title	Jackson-core	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Jackson-core	Medium
Product	pom	artifactid	jackson-core	Highest
Product	pom	developer email	tatu@fasterxml.com	Low
Product	pom	developer id	cowtowncoder	Low
Product	pom	developer name	Tatu Saloranta	Low
Product	pom	groupid	tools.jackson.core	Highest
Product	pom	name	Jackson-core	High
Product	pom	parent-artifactid	jackson-base	Medium
Product	pom	parent-groupid	tools.jackson	Medium
Product	pom	url	FasterXML/jackson-core	High
Version	file	version	3.1.5	High
Version	Manifest	Bundle-Version	3.1.5	High
Version	Manifest	Implementation-Version	3.1.5	High
Version	pom	version	3.1.5	Highest

Identifiers

pkg:maven/tools.jackson.core/jackson-core@3.1.5 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:3.1.5:*:*:*:*:*:*:* (Confidence:Highest)

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar
MD5: 99769ad660a66c43caee5d539d19ed96
SHA1: 09e495680be707d466527d734368ebf36e464da2
SHA256:3888e9e69ab66fbacaacc9aea0e9ffbf15368288e4aca468b024dba11c09fbf9
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-databind	High
Vendor	jar	package name	databind	Highest
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-databind	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-databind	Highest
Vendor	pom	artifactid	jackson-databind	Low
Vendor	pom	groupid	com.fasterxml.jackson.core	Highest
Vendor	pom	name	jackson-databind	High
Vendor	pom	parent-artifactid	jackson-base	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson	Medium
Vendor	pom	url	FasterXML/jackson	Highest
Product	file	name	jackson-databind	High
Product	hint analyzer	product	java8	Highest
Product	hint analyzer	product	modules	Highest
Product	jar	package name	databind	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Product	Manifest	Bundle-Name	jackson-databind	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-databind	Medium
Product	Manifest	Implementation-Title	jackson-databind	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	jackson-databind	Medium
Product	pom	artifactid	jackson-databind	Highest
Product	pom	groupid	com.fasterxml.jackson.core	Highest
Product	pom	name	jackson-databind	High
Product	pom	parent-artifactid	jackson-base	Medium
Product	pom	parent-groupid	com.fasterxml.jackson	Medium
Product	pom	url	FasterXML/jackson	High
Version	file	version	2.21.4	High
Version	Manifest	Bundle-Version	2.21.4	High
Version	Manifest	Implementation-Version	2.21.4	High
Version	pom	version	2.21.4	Highest

Identifiers

pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:2.21.4:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-databind:2.21.4:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2026-54515

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security-advisories@github.com - ISSUE_TRACKING
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.22.2/jackson-databind-2.22.2.jar
MD5: f67b45152b83310e3d75ffefc5b7ce32
SHA1: 921bd2092b0c539b2876de7063d55c72edcd05d3
SHA256:d0da14c12b16b5d54719aa172d83b542ff4abeb8b0fb7db476fde8ceece760ca
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-databind	High
Vendor	jar	package name	databind	Highest
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-databind	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-databind	Highest
Vendor	pom	artifactid	jackson-databind	Low
Vendor	pom	groupid	com.fasterxml.jackson.core	Highest
Vendor	pom	name	jackson-databind	High
Vendor	pom	parent-artifactid	jackson-base	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson	Medium
Vendor	pom	url	FasterXML/jackson	Highest
Product	file	name	jackson-databind	High
Product	hint analyzer	product	java8	Highest
Product	hint analyzer	product	modules	Highest
Product	jar	package name	databind	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Product	Manifest	Bundle-Name	jackson-databind	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.core.jackson-databind	Medium
Product	Manifest	Implementation-Title	jackson-databind	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	jackson-databind	Medium
Product	pom	artifactid	jackson-databind	Highest
Product	pom	groupid	com.fasterxml.jackson.core	Highest
Product	pom	name	jackson-databind	High
Product	pom	parent-artifactid	jackson-base	Medium
Product	pom	parent-groupid	com.fasterxml.jackson	Medium
Product	pom	url	FasterXML/jackson	High
Version	file	version	2.22.2	High
Version	Manifest	Bundle-Version	2.22.2	High
Version	Manifest	Implementation-Version	2.22.2	High
Version	pom	version	2.22.2	Highest

Identifiers

pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.2 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:2.22.2:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-databind:2.22.2:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.22.2:*:*:*:*:*:*:* (Confidence:Low)

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/tools/jackson/core/jackson-databind/3.1.5/jackson-databind-3.1.5.jar
MD5: 7b399cbb2bea1429c46c1b8c73af42b9
SHA1: 782178f0b1fe088803c03b85eb9a406f60519044
SHA256:3a2338d996fd3056791df8d335fa9ba8a62a706ed4245ecf81b3e583df37d08a
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-databind	High
Vendor	jar	package name	databind	Highest
Vendor	jar	package name	jackson	Highest
Vendor	jar	package name	tools	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Vendor	Manifest	bundle-symbolicname	tools.jackson.core.jackson-databind	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	tools.jackson.core	Medium
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-databind	Highest
Vendor	pom	artifactid	jackson-databind	Low
Vendor	pom	groupid	tools.jackson.core	Highest
Vendor	pom	name	jackson-databind	High
Vendor	pom	parent-artifactid	jackson-base	Low
Vendor	pom	parent-groupid	tools.jackson	Medium
Vendor	pom	url	FasterXML/jackson	Highest
Product	file	name	jackson-databind	High
Product	jar	package name	databind	Highest
Product	jar	package name	jackson	Highest
Product	jar	package name	tools	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson	Low
Product	Manifest	Bundle-Name	jackson-databind	Medium
Product	Manifest	bundle-symbolicname	tools.jackson.core.jackson-databind	Medium
Product	Manifest	Implementation-Title	jackson-databind	High
Product	Manifest	specification-title	jackson-databind	Medium
Product	pom	artifactid	jackson-databind	Highest
Product	pom	groupid	tools.jackson.core	Highest
Product	pom	name	jackson-databind	High
Product	pom	parent-artifactid	jackson-base	Medium
Product	pom	parent-groupid	tools.jackson	Medium
Product	pom	url	FasterXML/jackson	High
Version	file	version	3.1.5	High
Version	Manifest	Bundle-Version	3.1.5	High
Version	Manifest	Implementation-Version	3.1.5	High
Version	pom	version	3.1.5	Highest

Identifiers

pkg:maven/tools.jackson.core/jackson-databind@3.1.5 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-core:3.1.5:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:fasterxml:jackson-databind:3.1.5:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Add-on module for Jackson (https://github.com/FasterXML/jackson) to support
JDK 8 data types.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/datatype/jackson-datatype-jdk8/2.21.4/jackson-datatype-jdk8-2.21.4.jar
MD5: 282ec253ef93128ef2df436f02971b98
SHA1: 0a1b9fe3b6e8d4418fe09a1ba9a8f6640137cfb5
SHA256:2dde4a8f1aad3306c040f56ff40da81c6d58dcef3434c00849c9bce09f56a074
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-datatype-jdk8	High
Vendor	jar	package name	datatype	Highest
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	jar	package name	jdk8	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jdk8	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.datatype.jackson-datatype-jdk8	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.datatype	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-datatype-jdk8	Highest
Vendor	pom	artifactid	jackson-datatype-jdk8	Low
Vendor	pom	groupid	com.fasterxml.jackson.datatype	Highest
Vendor	pom	name	Jackson datatype: jdk8	High
Vendor	pom	parent-artifactid	jackson-modules-java8	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson.module	Medium
Product	file	name	jackson-datatype-jdk8	High
Product	jar	package name	datatype	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	jar	package name	jdk8	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jdk8	Low
Product	Manifest	Bundle-Name	Jackson datatype: jdk8	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.datatype.jackson-datatype-jdk8	Medium
Product	Manifest	Implementation-Title	Jackson datatype: jdk8	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Jackson datatype: jdk8	Medium
Product	pom	artifactid	jackson-datatype-jdk8	Highest
Product	pom	groupid	com.fasterxml.jackson.datatype	Highest
Product	pom	name	Jackson datatype: jdk8	High
Product	pom	parent-artifactid	jackson-modules-java8	Medium
Product	pom	parent-groupid	com.fasterxml.jackson.module	Medium
Version	file	version	2.21.4	High
Version	Manifest	Bundle-Version	2.21.4	High
Version	Manifest	Implementation-Version	2.21.4	High
Version	pom	version	2.21.4	Highest

Related Dependencies

Identifiers

pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.21.4 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:* (Confidence:Low)

Description:

Add-on module for Jackson (https://github.com/FasterXML/jackson) to support
JDK 8 data types.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/fasterxml/jackson/datatype/jackson-datatype-jdk8/2.22.2/jackson-datatype-jdk8-2.22.2.jar
MD5: f51580056a3d38a505c30523f8b8c33f
SHA1: 0b900dd7125fa16cfdf46135d3ffb3243d0f8b88
SHA256:5a767cc4bcb04034497422551ad5005b3affa3c8d691bda26d1e7f473485dc15
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jackson-datatype-jdk8	High
Vendor	jar	package name	datatype	Highest
Vendor	jar	package name	fasterxml	Highest
Vendor	jar	package name	jackson	Highest
Vendor	jar	package name	jdk8	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jdk8	Low
Vendor	Manifest	bundle-symbolicname	com.fasterxml.jackson.datatype.jackson-datatype-jdk8	Medium
Vendor	Manifest	Implementation-Vendor	FasterXML	High
Vendor	Manifest	Implementation-Vendor-Id	com.fasterxml.jackson.datatype	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	FasterXML	Low
Vendor	pom	artifactid	jackson-datatype-jdk8	Highest
Vendor	pom	artifactid	jackson-datatype-jdk8	Low
Vendor	pom	groupid	com.fasterxml.jackson.datatype	Highest
Vendor	pom	name	Jackson datatype: jdk8	High
Vendor	pom	parent-artifactid	jackson-modules-java8	Low
Vendor	pom	parent-groupid	com.fasterxml.jackson.module	Medium
Product	file	name	jackson-datatype-jdk8	High
Product	jar	package name	datatype	Highest
Product	jar	package name	fasterxml	Highest
Product	jar	package name	jackson	Highest
Product	jar	package name	jdk8	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jdk8	Low
Product	Manifest	Bundle-Name	Jackson datatype: jdk8	Medium
Product	Manifest	bundle-symbolicname	com.fasterxml.jackson.datatype.jackson-datatype-jdk8	Medium
Product	Manifest	Implementation-Title	Jackson datatype: jdk8	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Jackson datatype: jdk8	Medium
Product	pom	artifactid	jackson-datatype-jdk8	Highest
Product	pom	groupid	com.fasterxml.jackson.datatype	Highest
Product	pom	name	Jackson datatype: jdk8	High
Product	pom	parent-artifactid	jackson-modules-java8	Medium
Product	pom	parent-groupid	com.fasterxml.jackson.module	Medium
Version	file	version	2.22.2	High
Version	Manifest	Bundle-Version	2.22.2	High
Version	Manifest	Implementation-Version	2.22.2	High
Version	pom	version	2.22.2	Highest

Related Dependencies

Identifiers

pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.22.2 (Confidence:High)
cpe:2.3:a:fasterxml:jackson-modules-java8:2.22.2:*:*:*:*:*:*:* (Confidence:Low)

Description:

Jakarta Annotations API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/annotation/jakarta.annotation-api/1.3.5/jakarta.annotation-api-1.3.5.jar
MD5: 8b165cf58df5f8c2a222f637c0a07c97
SHA1: 59eb84ee0d616332ff44aba065f3888cf002cd2d
SHA256:85fb03fc054cdf4efca8efd9b6712bbb418e1ab98241c4539c8585bbc23e1b8a
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-jetty:provided
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile

pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.annotation-api	High
Vendor	jar	package name	annotation	Highest
Vendor	Manifest	automatic-module-name	java.annotation	Medium
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.annotation-api	Medium
Vendor	Manifest	extension-name	jakarta.annotation	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.glassfish	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.annotation-api	Highest
Vendor	pom	artifactid	jakarta.annotation-api	Low
Vendor	pom	developer name	Linda De Michiel	Medium
Vendor	pom	developer org	Oracle Corp.	Medium
Vendor	pom	groupid	jakarta.annotation	Highest
Vendor	pom	name	Jakarta Annotations API	High
Vendor	pom	parent-artifactid	ca-parent	Low
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.ca	Highest
Product	file	name	jakarta.annotation-api	High
Product	jar	package name	annotation	Highest
Product	Manifest	automatic-module-name	java.annotation	Medium
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Annotations API	Medium
Product	Manifest	bundle-symbolicname	jakarta.annotation-api	Medium
Product	Manifest	extension-name	jakarta.annotation	Medium
Product	pom	artifactid	jakarta.annotation-api	Highest
Product	pom	developer name	Linda De Michiel	Low
Product	pom	developer org	Oracle Corp.	Low
Product	pom	groupid	jakarta.annotation	Highest
Product	pom	name	Jakarta Annotations API	High
Product	pom	parent-artifactid	ca-parent	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.ca	Medium
Version	file	version	1.3.5	High
Version	Manifest	Bundle-Version	1.3.5	High
Version	Manifest	Implementation-Version	1.3.5	High
Version	pom	version	1.3.5	Highest

Identifiers

pkg:maven/jakarta.annotation/jakarta.annotation-api@1.3.5 (Confidence:High)

Description:

Jakarta Annotations API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/annotation/jakarta.annotation-api/2.1.1/jakarta.annotation-api-2.1.1.jar
MD5: 5dac2f68e8288d0add4dc92cb161711d
SHA1: 48b9bda22b091b1f48b13af03fe36db3be6e1ae3
SHA256:5f65fdaf424eee2b55e1d882ba9bb376be93fb09b37b808be6e22e8851c909fe
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.annotation-api	High
Vendor	jar	package name	annotation	Highest
Vendor	jar	package name	jakarta	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.annotation-api	Medium
Vendor	Manifest	extension-name	jakarta.annotation	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.glassfish	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.annotation-api	Highest
Vendor	pom	artifactid	jakarta.annotation-api	Low
Vendor	pom	developer name	Dmitry Kornilov	Medium
Vendor	pom	developer name	Linda De Michiel	Medium
Vendor	pom	developer org	Oracle Corp.	Medium
Vendor	pom	groupid	jakarta.annotation	Highest
Vendor	pom	name	Jakarta Annotations API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.ca	Highest
Product	file	name	jakarta.annotation-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Annotations API	Medium
Product	Manifest	bundle-symbolicname	jakarta.annotation-api	Medium
Product	Manifest	extension-name	jakarta.annotation	Medium
Product	pom	artifactid	jakarta.annotation-api	Highest
Product	pom	developer name	Dmitry Kornilov	Low
Product	pom	developer name	Linda De Michiel	Low
Product	pom	developer org	Oracle Corp.	Low
Product	pom	groupid	jakarta.annotation	Highest
Product	pom	name	Jakarta Annotations API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.ca	Medium
Version	file	version	2.1.1	High
Version	Manifest	Bundle-Version	2.1.1	High
Version	Manifest	Implementation-Version	2.1.1	High
Version	pom	parent-version	2.1.1	Low
Version	pom	version	2.1.1	Highest

Identifiers

pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1 (Confidence:High)

Description:

Jakarta Annotations API

License:

EPL 2.0: https://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/annotation/jakarta.annotation-api/3.0.0/jakarta.annotation-api-3.0.0.jar
MD5: 7faffaab962918da4cf5ddfd76609dd2
SHA1: 54f928fadec906a99d558536756d171917b9d936
SHA256:b01f55552284cfb149411e64eabca75e942d26d2e1786b32914250e4330afaa2
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-jetty-jakarta:provided
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile

pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-security@4.1.1
pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.annotation-api	High
Vendor	jar	package name	annotation	Highest
Vendor	jar	package name	jakarta	Highest
Vendor	Manifest	build-jdk-spec	18	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.annotation-api	Medium
Vendor	Manifest	extension-name	jakarta.annotation	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.glassfish	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.annotation-api	Highest
Vendor	pom	artifactid	jakarta.annotation-api	Low
Vendor	pom	developer name	Dmitry Kornilov	Medium
Vendor	pom	developer name	Linda De Michiel	Medium
Vendor	pom	developer org	Oracle Corp.	Medium
Vendor	pom	groupid	jakarta.annotation	Highest
Vendor	pom	name	Jakarta Annotations API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.ca	Highest
Product	file	name	jakarta.annotation-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	build-jdk-spec	18	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Annotations API	Medium
Product	Manifest	bundle-symbolicname	jakarta.annotation-api	Medium
Product	Manifest	extension-name	jakarta.annotation	Medium
Product	pom	artifactid	jakarta.annotation-api	Highest
Product	pom	developer name	Dmitry Kornilov	Low
Product	pom	developer name	Linda De Michiel	Low
Product	pom	developer org	Oracle Corp.	Low
Product	pom	groupid	jakarta.annotation	Highest
Product	pom	name	Jakarta Annotations API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.ca	Medium
Version	file	version	3.0.0	High
Version	Manifest	Bundle-Version	3.0.0	High
Version	Manifest	Implementation-Version	3.0.0	High
Version	pom	parent-version	3.0.0	Low
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0 (Confidence:High)

Description:

        Jakarta Expression Language provides a specification document, API, reference implementation and TCK 
        that describes an expression language for Java applications.

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/org/glassfish/jakarta.el/3.0.4/jakarta.el-3.0.4.jar
MD5: a4ff0d711c405e054f8166c2ea893e0e
SHA1: f48473482c0e3e714f87186d9305bcae30b7f5cb
SHA256:3b8d4311b47fb47d168ad4338b6649a7cc21d5066b9765bd28ebca93148064be
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.el	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	expression	Highest
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	sun	Highest
Vendor	jar (hint)	package name	oracle	Highest
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	com.sun.el.javax.el	Medium
Vendor	Manifest	extension-name	javax.el	Medium
Vendor	Manifest	Implementation-Vendor	Oracle Corporation	High
Vendor	Manifest	specification-vendor	Oracle Corporation	Low
Vendor	pom	artifactid	jakarta.el	Highest
Vendor	pom	artifactid	jakarta.el	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	org.glassfish	Highest
Vendor	pom	name	Jakarta Expression Language 3.0	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.el	Highest
Product	file	name	jakarta.el	High
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	sun	Highest
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Expression Language 3.0	Medium
Product	Manifest	bundle-symbolicname	com.sun.el.javax.el	Medium
Product	Manifest	extension-name	javax.el	Medium
Product	pom	artifactid	jakarta.el	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	org.glassfish	Highest
Product	pom	name	Jakarta Expression Language 3.0	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.el	Medium
Version	file	version	3.0.4	High
Version	Manifest	Bundle-Version	3.0.4	High
Version	Manifest	Implementation-Version	3.0.4	High
Version	pom	parent-version	3.0.4	Low
Version	pom	version	3.0.4	Highest

Identifiers

pkg:maven/org.glassfish/jakarta.el@3.0.4 (Confidence:High)
cpe:2.3:a:eclipse:jakarta_expression_language:3.0.4:*:*:*:*:*:*:* (Confidence:Low)

Description:

        Jakarta Expression Language defines an expression language for Java applications

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/el/jakarta.el-api/3.0.3/jakarta.el-api-3.0.3.jar
MD5: 528ed6138395d22fb54912b2b889e88e
SHA1: f311ab94bb1d4380690a53d737226a6b879dd4f1
SHA256:47ae0a91fb6dd32fdaa5d9bda63df043ac8148e00c297ccce8ab9c56b95cf261
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	expression	Highest
Vendor	jar	package name	javax	Highest
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	javax.el-api	Medium
Vendor	Manifest	extension-name	javax.el	Medium
Vendor	Manifest	Implementation-Vendor	Oracle Corporation	High
Vendor	Manifest	specification-vendor	Oracle Corporation	Low
Vendor	pom	artifactid	jakarta.el-api	Highest
Vendor	pom	artifactid	jakarta.el-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.el	Highest
Vendor	pom	name	Jakarta Expression Language 3.0 API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.el	Highest
Product	file	name	jakarta.el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Expression Language 3.0 API	Medium
Product	Manifest	bundle-symbolicname	javax.el-api	Medium
Product	Manifest	extension-name	javax.el	Medium
Product	pom	artifactid	jakarta.el-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.el	Highest
Product	pom	name	Jakarta Expression Language 3.0 API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.el	Medium
Version	file	version	3.0.3	High
Version	Manifest	Bundle-Version	3.0.3	High
Version	Manifest	Implementation-Version	3.0.3	High
Version	pom	parent-version	3.0.3	Low
Version	pom	version	3.0.3	Highest

Identifiers

pkg:maven/jakarta.el/jakarta.el-api@3.0.3 (Confidence:High)
cpe:2.3:a:eclipse:jakarta_expression_language:3.0.3:*:*:*:*:*:*:* (Confidence:Low)

Description:

        Jakarta Expression Language defines an expression language for Java applications

License:

https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt, https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/el/jakarta.el-api/6.0.1/jakarta.el-api-6.0.1.jar
MD5: a98f097e059552a75748fcdd067e5c16
SHA1: c7c4a2eb1e40e0ff45ab5e2e52bd77d8c7a75176
SHA256:7e84b5bed49de32b79cc5e85d90b6f5adb1a953ac67283adbb41c1e297f9c605
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	expression	Highest
Vendor	jar	package name	jakarta	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.el-api	Medium
Vendor	Manifest	extension-name	jakarta.el	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.el-api	Highest
Vendor	pom	artifactid	jakarta.el-api	Low
Vendor	pom	developer email	el-dev@eclipse.org	Low
Vendor	pom	developer id	jakarta-ee4j-el	Medium
Vendor	pom	developer name	Jakarta Expression Language Developers	Medium
Vendor	pom	developer org	Eclipse Foundation	Medium
Vendor	pom	groupid	jakarta.el	Highest
Vendor	pom	name	Jakarta Expression Language API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.el	Highest
Product	file	name	jakarta.el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Expression Language API	Medium
Product	Manifest	bundle-symbolicname	jakarta.el-api	Medium
Product	Manifest	extension-name	jakarta.el	Medium
Product	pom	artifactid	jakarta.el-api	Highest
Product	pom	developer email	el-dev@eclipse.org	Low
Product	pom	developer id	jakarta-ee4j-el	Low
Product	pom	developer name	Jakarta Expression Language Developers	Low
Product	pom	developer org	Eclipse Foundation	Low
Product	pom	groupid	jakarta.el	Highest
Product	pom	name	Jakarta Expression Language API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.el	Medium
Version	file	version	6.0.1	High
Version	Manifest	Bundle-Version	6.0.1	High
Version	Manifest	Implementation-Version	6.0.1	High
Version	pom	parent-version	6.0.1	Low
Version	pom	version	6.0.1	Highest

Identifiers

pkg:maven/jakarta.el/jakarta.el-api@6.0.1 (Confidence:High)
cpe:2.3:a:eclipse:jakarta_expression_language:6.0.1:*:*:*:*:*:*:* (Confidence:Low)

Description:

Java(TM) Servlet 4.0 API Design Specification

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/4.0.2/jakarta.servlet-api-4.0.2.jar
MD5: 75523dea16c815e4b111796ea1679b1b
SHA1: 60da427ed588aa0cf70cb6cb7209c31e83069364
SHA256:0cd32c92320ae92c8692ef326dfeef756e97760251fca0c45472f299f1c3c916
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet-api	High
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Vendor	Manifest	extension-name	javax.servlet	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.glassfish	Medium
Vendor	Manifest	specification-vendor	Oracle Corporation	Low
Vendor	pom	artifactid	jakarta.servlet-api	Highest
Vendor	pom	artifactid	jakarta.servlet-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.servlet	Highest
Vendor	pom	name	Java Servlet API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Highest
Product	file	name	jakarta.servlet-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Java Servlet API	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Product	Manifest	extension-name	javax.servlet	Medium
Product	pom	artifactid	jakarta.servlet-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.servlet	Highest
Product	pom	name	Java Servlet API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Medium
Version	file	version	4.0.2	High
Version	Manifest	Implementation-Version	4.0.2	High
Version	pom	parent-version	4.0.2	Low
Version	pom	version	4.0.2	Highest

Identifiers

pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.2 (Confidence:High)

Description:

Jakarta Servlet 4.0

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/4.0.4/jakarta.servlet-api-4.0.4.jar
MD5: f5d1d7a29978e4ae0be5a456ee1c65c3
SHA1: b8a1142e04838fe54194049c6e7a18dae8f9b960
SHA256:586e27706c21258f5882f43be06904f49b02db9ac54e345d393fe4a32494d127
Referenced In Projects/Scopes:

waffle-demo-filter:provided
waffle-demo-form:provided
waffle-demo-jaas:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate:provided
waffle-demo-parent:provided
waffle-demo-spring-boot-filter2:provided
waffle-demo-spring-filter:provided
waffle-demo-spring-form:provided
waffle-jna:provided
waffle-shiro:provided
waffle-spring-security5:provided
waffle-tests:provided

pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-parent@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet-api	High
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	automatic-module-name	java.servlet	Medium
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Vendor	Manifest	extension-name	javax.servlet	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.eclipse	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet-api	Highest
Vendor	pom	artifactid	jakarta.servlet-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.servlet	Highest
Vendor	pom	name	Jakarta Servlet	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Highest
Product	file	name	jakarta.servlet-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	automatic-module-name	java.servlet	Medium
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Servlet	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Product	Manifest	extension-name	javax.servlet	Medium
Product	pom	artifactid	jakarta.servlet-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.servlet	Highest
Product	pom	name	Jakarta Servlet	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Medium
Version	file	version	4.0.4	High
Version	Manifest	Implementation-Version	4.0.4	High
Version	pom	parent-version	4.0.4	Low
Version	pom	version	4.0.4	Highest

Identifiers

pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.4 (Confidence:High)

Description:

Jakarta Servlet 6.0

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/6.0.0/jakarta.servlet-api-6.0.0.jar
MD5: 4bcb3175ed9b7aa3f038d082879ec2a8
SHA1: abecc699286e65035ebba9844c03931357a6a963
SHA256:c034eb1afb158987dbb53a5fea0cadf611c8dae8daadd59c44d9d5ab70129cef
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-servlet@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet-api	High
Vendor	jar	package name	jakarta	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Vendor	Manifest	extension-name	jakarta.servlet	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.eclipse	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet-api	Highest
Vendor	pom	artifactid	jakarta.servlet-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.servlet	Highest
Vendor	pom	name	Jakarta Servlet	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Highest
Product	file	name	jakarta.servlet-api	High
Product	jar	package name	jakarta	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Servlet	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Product	Manifest	extension-name	jakarta.servlet	Medium
Product	pom	artifactid	jakarta.servlet-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.servlet	Highest
Product	pom	name	Jakarta Servlet	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Medium
Version	file	version	6.0.0	High
Version	Manifest	Bundle-Version	6.0.0	High
Version	Manifest	Implementation-Version	6.0.0	High
Version	pom	parent-version	6.0.0	Low
Version	pom	version	6.0.0	Highest

Identifiers

pkg:maven/jakarta.servlet/jakarta.servlet-api@6.0.0 (Confidence:High)

Description:

Jakarta Servlet 6.1

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/6.1.0/jakarta.servlet-api-6.1.0.jar
MD5: 314c930b3e40ac1abc3529c7c9942f09
SHA1: 1169a246913fe3823782af7943e7a103634867c5
SHA256:8a31f465f3593bf2351531a5c952014eb839da96a605b5825b93dd54714c48c4
Referenced In Projects/Scopes:

waffle-demo-filter-jakarta:provided
waffle-demo-form-jakarta:provided
waffle-demo-jaas-jakarta:provided
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-parent-jakarta:provided
waffle-demo-spring-boot-filter3:provided
waffle-demo-spring-boot-filter4:provided
waffle-demo-spring-filter-jakarta:provided
waffle-demo-spring-form-jakarta:provided
waffle-jna-jakarta:provided
waffle-shiro-jakarta:provided
waffle-spring-security6:provided
waffle-spring-security7:provided
waffle-tests-jakarta:provided

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-parent-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet-api	High
Vendor	jar	package name	jakarta	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Vendor	Manifest	extension-name	jakarta.servlet	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.eclipse	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet-api	Highest
Vendor	pom	artifactid	jakarta.servlet-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.servlet	Highest
Vendor	pom	name	Jakarta Servlet	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Highest
Product	file	name	jakarta.servlet-api	High
Product	jar	package name	jakarta	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Servlet	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Product	Manifest	extension-name	jakarta.servlet	Medium
Product	pom	artifactid	jakarta.servlet-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.servlet	Highest
Product	pom	name	Jakarta Servlet	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Medium
Version	file	version	6.1.0	High
Version	Manifest	Bundle-Version	6.1.0	High
Version	Manifest	Implementation-Version	6.1.0	High
Version	pom	parent-version	6.1.0	Low
Version	pom	version	6.1.0	Highest

Identifiers

pkg:maven/jakarta.servlet/jakarta.servlet-api@6.1.0 (Confidence:High)

Description:

JavaServer Pages API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/org/glassfish/web/jakarta.servlet.jsp/2.3.6/jakarta.servlet.jsp-2.3.6.jar
MD5: 16d8baeceb5503f066c61582085c75cb
SHA1: 13192d5874b787c0ce0c70b35e95181e8b683a1c
SHA256:990af769158db75833fe8b4d1e56ea778246bc3c6522d434369f1a0bcebf8582
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp	High
Vendor	jar	package name	api	Highest
Vendor	jar	package name	glassfish	Highest
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp	Medium
Vendor	Manifest	extension-name	javax.servlet.jsp	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com	Medium
Vendor	pom	groupid	org.glassfish.web	Highest
Vendor	pom	name	JSP implementation	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Highest
Product	file	name	jakarta.servlet.jsp	High
Product	jar	package name	api	Highest
Product	jar	package name	glassfish	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	JSP implementation	Medium
Product	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp	Medium
Product	Manifest	extension-name	javax.servlet.jsp	Medium
Product	pom	artifactid	jakarta.servlet.jsp	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com	Low
Product	pom	groupid	org.glassfish.web	Highest
Product	pom	name	JSP implementation	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Medium
Version	file	version	2.3.6	High
Version	Manifest	Bundle-Version	2.3.6	High
Version	Manifest	Implementation-Version	2.3.6	High
Version	pom	parent-version	2.3.6	Low
Version	pom	version	2.3.6	Highest

Identifiers

pkg:maven/org.glassfish.web/jakarta.servlet.jsp@2.3.6 (Confidence:High)
cpe:2.3:a:oracle:jsp:2.3.6:*:*:*:*:*:*:* (Confidence:Medium)

Description:

JavaServer Pages API

License:

https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt, https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/org/glassfish/web/jakarta.servlet.jsp/3.0.0/jakarta.servlet.jsp-3.0.0.jar
MD5: fca522b72282d53d0819af32a5a2ec9c
SHA1: a1b306dd295439765d0fd2f9b00a48501c892b88
SHA256:7dde5d9789c030401c80bdfdbcc7a021665a451ba6f4ebdc033196cb7c8dee2a
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp	High
Vendor	jar	package name	api	Highest
Vendor	jar	package name	glassfish	Highest
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp	Medium
Vendor	Manifest	extension-name	jakarta.servlet.jsp	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp	Low
Vendor	pom	developer email	jsp-dev@eclipse.org	Low
Vendor	pom	developer id	jakarta-ee4j-jsp	Medium
Vendor	pom	developer name	Jakarta Server Pages Developers	Medium
Vendor	pom	developer org	Eclipse Foundation	Medium
Vendor	pom	groupid	org.glassfish.web	Highest
Vendor	pom	name	Jakarta Server Pages implementation	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Highest
Product	file	name	jakarta.servlet.jsp	High
Product	jar	package name	api	Highest
Product	jar	package name	glassfish	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Server Pages implementation	Medium
Product	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp	Medium
Product	Manifest	extension-name	jakarta.servlet.jsp	Medium
Product	pom	artifactid	jakarta.servlet.jsp	Highest
Product	pom	developer email	jsp-dev@eclipse.org	Low
Product	pom	developer id	jakarta-ee4j-jsp	Low
Product	pom	developer name	Jakarta Server Pages Developers	Low
Product	pom	developer org	Eclipse Foundation	Low
Product	pom	groupid	org.glassfish.web	Highest
Product	pom	name	Jakarta Server Pages implementation	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Medium
Version	file	version	3.0.0	High
Version	Manifest	Bundle-Version	3.0.0	High
Version	Manifest	Implementation-Version	3.0.0	High
Version	pom	parent-version	3.0.0	Low
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/org.glassfish.web/jakarta.servlet.jsp@3.0.0 (Confidence:High)

Description:

Jakarta Server Pages API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jsp/jakarta.servlet.jsp-api/2.3.6/jakarta.servlet.jsp-api-2.3.6.jar
MD5: 07e4d801fad7599ae858cb6b779b5168
SHA1: ee48550ece1af1e0d8bd4877dbc6da5c29c5496b
SHA256:e915fa9db7245592460dfaf1a2df9cdfe800cc3976562ed492870db56369dde9
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp-api	High
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	javax.servlet.jsp-api	Medium
Vendor	Manifest	extension-name	javax.servlet.jsp	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	originally-created-by	1.7.0_80 (Oracle Corporation)	Low
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp-api	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com	Medium
Vendor	pom	groupid	jakarta.servlet.jsp	Highest
Vendor	pom	name	Jakarta Server Pages API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Highest
Product	file	name	jakarta.servlet.jsp-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Server Pages API	Medium
Product	Manifest	bundle-symbolicname	javax.servlet.jsp-api	Medium
Product	Manifest	extension-name	javax.servlet.jsp	Medium
Product	Manifest	originally-created-by	1.7.0_80 (Oracle Corporation)	Low
Product	pom	artifactid	jakarta.servlet.jsp-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com	Low
Product	pom	groupid	jakarta.servlet.jsp	Highest
Product	pom	name	Jakarta Server Pages API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Medium
Version	file	version	2.3.6	High
Version	Manifest	Bundle-Version	2.3.6	High
Version	Manifest	Implementation-Version	2.3.6	High
Version	pom	parent-version	2.3.6	Low
Version	pom	version	2.3.6	Highest

Identifiers

pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@2.3.6 (Confidence:High)
cpe:2.3:a:oracle:jsp:2.3.6:*:*:*:*:*:*:* (Confidence:Medium)

Description:

Jakarta Server Pages API

License:

https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt, https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jsp/jakarta.servlet.jsp-api/4.0.0/jakarta.servlet.jsp-api-4.0.0.jar
MD5: 6fddc938119e00e6f934c1b37120e338
SHA1: a8de3741b91ba7427306104979ab2f084e831438
SHA256:873b7d0c2b5734ef8847634299b67ce879080cdece8426147522c4db8e37c14e
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp-api	High
Vendor	jar	package name	jakarta	Highest
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet.jsp-api	Medium
Vendor	Manifest	extension-name	jakarta.servlet.jsp	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp-api	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp-api	Low
Vendor	pom	developer email	jsp-dev@eclipse.org	Low
Vendor	pom	developer id	jakarta-ee4j-jsp	Medium
Vendor	pom	developer name	Jakarta Server Pages Developers	Medium
Vendor	pom	developer org	Eclipse Foundation	Medium
Vendor	pom	groupid	jakarta.servlet.jsp	Highest
Vendor	pom	name	Jakarta Server Pages API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Highest
Product	file	name	jakarta.servlet.jsp-api	High
Product	jar	package name	jakarta	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Server Pages API	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet.jsp-api	Medium
Product	Manifest	extension-name	jakarta.servlet.jsp	Medium
Product	pom	artifactid	jakarta.servlet.jsp-api	Highest
Product	pom	developer email	jsp-dev@eclipse.org	Low
Product	pom	developer id	jakarta-ee4j-jsp	Low
Product	pom	developer name	Jakarta Server Pages Developers	Low
Product	pom	developer org	Eclipse Foundation	Low
Product	pom	groupid	jakarta.servlet.jsp	Highest
Product	pom	name	Jakarta Server Pages API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jsp	Medium
Version	file	version	4.0.0	High
Version	Manifest	Bundle-Version	4.0.0	High
Version	Manifest	Implementation-Version	4.0.0	High
Version	pom	parent-version	4.0.0	Low
Version	pom	version	4.0.0	Highest

Identifiers

pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@4.0.0 (Confidence:High)

Description:

JavaServer Pages(TM) Standard Tag Library API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/org/glassfish/web/jakarta.servlet.jsp.jstl/1.2.6/jakarta.servlet.jsp.jstl-1.2.6.jar
MD5: 7058e8ed0b161b729e6134784750d22b
SHA1: f5a092de3b2b087c14ca4b8d6f2c77a1f6802828
SHA256:3b697c6cdf4d28de185e07d63f3682728b5a2b1dd229f5f9deb9b930d64b484a
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp.jstl	High
Vendor	jar	package name	oracle	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	jar (hint)	package name	sun	Highest
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp.jstl	Medium
Vendor	Manifest	extension-name	javax.servlet.jsp.jstl	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	originally-created-by	1.8.0_181 (Oracle Corporation)	Low
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp.jstl	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp.jstl	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	org.glassfish.web	Highest
Vendor	pom	name	JavaServer Pages (TM) TagLib Implementation	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jstl	Highest
Product	file	name	jakarta.servlet.jsp.jstl	High
Product	jar	package name	oracle	Highest
Product	jar	package name	org	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	JavaServer Pages (TM) TagLib Implementation	Medium
Product	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp.jstl	Medium
Product	Manifest	extension-name	javax.servlet.jsp.jstl	Medium
Product	Manifest	originally-created-by	1.8.0_181 (Oracle Corporation)	Low
Product	pom	artifactid	jakarta.servlet.jsp.jstl	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	org.glassfish.web	Highest
Product	pom	name	JavaServer Pages (TM) TagLib Implementation	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jstl	Medium
Version	file	version	1.2.6	High
Version	Manifest	Bundle-Version	1.2.6	High
Version	Manifest	Implementation-Version	1.2.6	High
Version	pom	parent-version	1.2.6	Low
Version	pom	version	1.2.6	Highest

Identifiers

pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6 (Confidence:High)
cpe:2.3:a:oracle:jsp:1.2.6:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Jakarta Standard Tag Library Implementation

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/org/glassfish/web/jakarta.servlet.jsp.jstl/3.0.1/jakarta.servlet.jsp.jstl-3.0.1.jar
MD5: 3f6511c0066616415b9ed23a018b1cde
SHA1: 078909a1354585b2a7a2d3b4e348fceff8b6d180
SHA256:5cc6e60b9e74d38c25fe4f2d22dfd40577f5b8396bc885f7061cd2c525a43b86
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp.jstl	High
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp.jstl	Medium
Vendor	Manifest	extension-name	jakarta.servlet.jsp.jstl	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp.jstl	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp.jstl	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	org.glassfish.web	Highest
Vendor	pom	name	Jakarta Standard Tag Library Implementation	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jstl	Highest
Product	file	name	jakarta.servlet.jsp.jstl	High
Product	jar	package name	eclipse	Highest
Product	jar	package name	org	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Standard Tag Library Implementation	Medium
Product	Manifest	bundle-symbolicname	org.glassfish.web.jakarta.servlet.jsp.jstl	Medium
Product	Manifest	extension-name	jakarta.servlet.jsp.jstl	Medium
Product	pom	artifactid	jakarta.servlet.jsp.jstl	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	org.glassfish.web	Highest
Product	pom	name	Jakarta Standard Tag Library Implementation	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jstl	Medium
Version	file	version	3.0.1	High
Version	Manifest	Bundle-Version	3.0.1	High
Version	Manifest	Implementation-Version	3.0.1	High
Version	pom	parent-version	3.0.1	Low
Version	pom	version	3.0.1	Highest

Identifiers

pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@3.0.1 (Confidence:High)
cpe:2.3:a:oracle:jsp:3.0.1:*:*:*:*:*:*:* (Confidence:Medium)

Description:

JavaServer Pages(TM) Standard Tag Library API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/1.2.4/jakarta.servlet.jsp.jstl-api-1.2.4.jar
MD5: 5b4683c3a614b37a5de721817e792024
SHA1: 9d23cda192df1192894277fd9d0710abb61329af
SHA256:57122ab0151f82e716d825e65627e8064eb108dbeaafafa780687d61d5359454
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet.jsp.jstl-api	High
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	jstl	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet.jsp.jstl-api	Medium
Vendor	Manifest	extension-name	javax.servlet.jsp.jstl	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	originally-created-by	1.8.0_181 (Oracle Corporation)	Low
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet.jsp.jstl-api	Highest
Vendor	pom	artifactid	jakarta.servlet.jsp.jstl-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.servlet.jsp.jstl	Highest
Vendor	pom	name	JavaServer Pages(TM) Standard Tag Library API	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.jstl	Highest
Product	file	name	jakarta.servlet.jsp.jstl-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	jstl	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	JavaServer Pages(TM) Standard Tag Library API	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet.jsp.jstl-api	Medium
Product	Manifest	extension-name	javax.servlet.jsp.jstl	Medium
Product	Manifest	originally-created-by	1.8.0_181 (Oracle Corporation)	Low
Product	pom	artifactid	jakarta.servlet.jsp.jstl-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.servlet.jsp.jstl	Highest
Product	pom	name	JavaServer Pages(TM) Standard Tag Library API	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.jstl	Medium
Version	file	version	1.2.4	High
Version	Manifest	Bundle-Version	1.2.4	High
Version	Manifest	Implementation-Version	1.2.4	High
Version	pom	parent-version	1.2.4	Low
Version	pom	version	1.2.4	Highest

Identifiers

pkg:maven/jakarta.servlet.jsp.jstl/jakarta.servlet.jsp.jstl-api@1.2.4 (Confidence:High)
cpe:2.3:a:oracle:jsp:1.2.4:*:*:*:*:*:*:* (Confidence:Medium)

File Path: /home/runner/.m2/repository/eclipse/jdtcore/3.1.0/jdtcore-3.1.0.jar
MD5: d1651bf9048165f304e7877f1eaad6dc
SHA1: c5e3e72ae7220118c3da808628ec7016d4d8aef2
SHA256:b163be93b2131f97dd23ee03c935b34f48c17e74d8f60b644747528ea024e88e
Referenced In Project/Scope: waffle-jetty-jakarta:provided
jdtcore-3.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.glassfish.web/jakarta.servlet.jsp@3.0.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jdtcore	High
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	jdt	Highest
Vendor	Manifest	bundle-localization	plugin	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core; singleton:=true	Medium
Vendor	Manifest	eclipse-autostart	true	Low
Vendor	pom	artifactid	jdtcore	Highest
Vendor	pom	artifactid	jdtcore	Low
Vendor	pom	groupid	eclipse	Highest
Vendor	pom	name	jdtcore	High
Product	file	name	jdtcore	High
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	jdt	Highest
Product	Manifest	bundle-localization	plugin	Low
Product	Manifest	Bundle-Name	%pluginName	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core; singleton:=true	Medium
Product	Manifest	eclipse-autostart	true	Low
Product	pom	artifactid	jdtcore	Highest
Product	pom	groupid	eclipse	Highest
Product	pom	name	jdtcore	High
Version	file	version	3.1.0	High
Version	Manifest	Bundle-Version	3.1.0	High
Version	pom	version	3.1.0	Highest

Identifiers

pkg:maven/eclipse/jdtcore@3.1.0 (Confidence:High)

File Path: /home/runner/.m2/repository/eclipse/jdtcore/3.1.0/jdtcore-3.1.0.jar/jdtCompilerAdapter.jar
MD5: e66287f3ce15029d202ffc9c2dc3aa77
SHA1: a9d9eb99b7920dd3ee24d601a26cd7e473b0bf6e
SHA256:c79595d136ba157fc63286bf29cee69f6ab09cf2b9005ce70ae7eb01431115d9
Referenced In Project/Scope: waffle-jetty-jakarta:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jdtCompilerAdapter	High
Vendor	jar	package name	core	Low
Vendor	jar	package name	eclipse	Low
Vendor	jar	package name	jdt	Low
Product	file	name	jdtCompilerAdapter	High
Product	jar	package name	core	Low
Product	jar	package name	jdt	Low

Identifiers

None

Description:

Jetty I/O Artifact

License:

EPL-2.0 OR Apache-2.0
https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-io/12.1.13/jetty-io-12.1.13.jar
MD5: 28eec03abed3ce7725ace9cd069bde24
SHA1: db1fedfa77d4723970cb5f1c68ea2ca3ebf24b27
SHA256:946338a5db4e906ba0698dcdae350394736062cf915b5f16ebf787bcee7fffae
Referenced In Projects/Scopes:

waffle-jetty-jakarta:provided
waffle-jetty:provided

pkg:maven/org.eclipse.jetty/jetty-client@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jetty-io	High
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	jetty	Highest
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-copyright	Copyright (c) 1995 Mort Bay Consulting Pty Ltd and others.	Low
Vendor	Manifest	bundle-docurl	https://jetty.org/	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jetty.io	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Jetty Project	High
Vendor	Manifest	url	https://jetty.org/	Low
Vendor	pom	artifactid	jetty-io	Highest
Vendor	pom	artifactid	jetty-io	Low
Vendor	pom	groupid	org.eclipse.jetty	Highest
Vendor	pom	name	Core :: IO	High
Vendor	pom	parent-artifactid	jetty-core	Low
Product	file	name	jetty-io	High
Product	jar	package name	eclipse	Highest
Product	jar	package name	io	Highest
Product	jar	package name	jetty	Highest
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-copyright	Copyright (c) 1995 Mort Bay Consulting Pty Ltd and others.	Low
Product	Manifest	bundle-docurl	https://jetty.org/	Low
Product	Manifest	Bundle-Name	Core :: IO	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jetty.io	Medium
Product	Manifest	url	https://jetty.org/	Low
Product	pom	artifactid	jetty-io	Highest
Product	pom	groupid	org.eclipse.jetty	Highest
Product	pom	name	Core :: IO	High
Product	pom	parent-artifactid	jetty-core	Medium
Version	file	version	12.1.13	High
Version	Manifest	Bundle-Version	12.1.13	High
Version	Manifest	Implementation-Version	12.1.13	High
Version	pom	version	12.1.13	Highest

Related Dependencies

jetty-alpn-client-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-alpn-client/12.1.13/jetty-alpn-client-12.1.13.jar
- MD5: 8517510f2ebd3e94613837e4f6d829cb
- SHA1: 2fd87336e916a935567fa925584f592fe42e6b55
- SHA256: 26aa9b360efa88c50915f6f62916d5527f24dbcf75995038a3b0d9553553e407
- pkg:maven/org.eclipse.jetty/jetty-alpn-client@12.1.13
jetty-client-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-client/12.1.13/jetty-client-12.1.13.jar
- MD5: 10e6ad4545d55609f20a7aedd8c3e7af
- SHA1: e702db1b5c16aab2ad962ffcc6e2c54d8cd75c28
- SHA256: a08216cc1388e454d5ddaa566bd3f3c5b7ac6b017773f36b37cdf462819f8415
- pkg:maven/org.eclipse.jetty/jetty-client@12.1.13
jetty-compression-common-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/compression/jetty-compression-common/12.1.13/jetty-compression-common-12.1.13.jar
- MD5: c144dcf5186aed122c6c0e962dcfcba7
- SHA1: a06610f85607b5ca14f34a7364e4213810f359d7
- SHA256: 91bf7b735619870fd369aed9d79372ed8e6cdba2e4b4c44131a2a78fa15d4737
- pkg:maven/org.eclipse.jetty.compression/jetty-compression-common@12.1.13
jetty-compression-gzip-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/compression/jetty-compression-gzip/12.1.13/jetty-compression-gzip-12.1.13.jar
- MD5: 79639a3532f303937d2660ccb62008b4
- SHA1: 968296c8c6965ff596c9d7f716510ca48e00a398
- SHA256: 987afca3706a82595533ab49b60281f77daba688a46f2a7b2ac9498c9484be7d
- pkg:maven/org.eclipse.jetty.compression/jetty-compression-gzip@12.1.13
jetty-ee-webapp-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee/jetty-ee-webapp/12.1.13/jetty-ee-webapp-12.1.13.jar
- MD5: 414f6cdfbd08bc02a132a3bd1cd467de
- SHA1: 94ee802d7ea1ef6682343c3a8705558974628179
- SHA256: 15c82c0ecd1be08ef776a06bf138f5351c2554d84fd02bd72aa1d0dc88c10a0e
- pkg:maven/org.eclipse.jetty.ee/jetty-ee-webapp@12.1.13
jetty-ee10-apache-jsp-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee10/jetty-ee10-apache-jsp/12.1.13/jetty-ee10-apache-jsp-12.1.13.jar
- MD5: bcdf961c3676bf08e1d8058958e0e4f4
- SHA1: 7210a565416d241c36f4ea2aa5bd73e53ff315e7
- SHA256: 4794a66e2541e11149f739d0375795eb537da5863c6a1ed54509584d0597c57e
- pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-apache-jsp@12.1.13
jetty-ee10-servlet-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee10/jetty-ee10-servlet/12.1.13/jetty-ee10-servlet-12.1.13.jar
- MD5: 431e27ef5e4ea5788eebd3eea312c74b
- SHA1: 218f042ca31945bd8e462621db72dacaa7250093
- SHA256: 361374c3bf4cc93d45275ca2e9f74a928e65e537e5f50da645113306a27dbe53
- pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-servlet@12.1.13
jetty-ee10-webapp-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee10/jetty-ee10-webapp/12.1.13/jetty-ee10-webapp-12.1.13.jar
- MD5: b70ea31dcfe41575977b02f7c6b46b85
- SHA1: 32803b76dc316d5af2479bfd2ef2978fffd4b14e
- SHA256: 18d128ccc41559f7ae1c41fa5a8f19ee5829bf8670fa63e9ce8a2abdbf5a4f9a
- pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-webapp@12.1.13
jetty-ee8-apache-jsp-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee8/jetty-ee8-apache-jsp/12.1.13/jetty-ee8-apache-jsp-12.1.13.jar
- MD5: f7a89c97cf8f5a8f58e4619b2699ec82
- SHA1: 4e2564c5cbfe95b3a1fa5de6879ff4b39fee632c
- SHA256: 7d64588946475938d02e6d183cd499b500e7d78f7df0430b376c522a3629aa26
- pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.13
jetty-ee8-nested-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee8/jetty-ee8-nested/12.1.13/jetty-ee8-nested-12.1.13.jar
- MD5: fec022938c4017f1af7eae004593c01b
- SHA1: 135ecf614228d827715593760ad2668c2f5c1c0e
- SHA256: 8b8f01f07ea260336a1b1be4f1fc395f1583e3c9375cce0bfd89ac05502a0661
- pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-nested@12.1.13
jetty-ee8-security-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee8/jetty-ee8-security/12.1.13/jetty-ee8-security-12.1.13.jar
- MD5: 0be040c9f8d4dbb70ae2a3a3dc600537
- SHA1: dd22fa27daee7a60555c72d6b6ab44714a5a9da0
- SHA256: 9edec53a81ca35aa5e5e56ff1f6b6c11a0869aff6877ca1948b876f5901ac061
- pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security@12.1.13
jetty-ee8-servlet-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee8/jetty-ee8-servlet/12.1.13/jetty-ee8-servlet-12.1.13.jar
- MD5: d2c35324cf1e4b17825127c8e51d97fa
- SHA1: 2be5a71cc8e5eb3edf39cf4c882b9f1446fb87d8
- SHA256: 084695e621ad2204744e13f66a7dfc3187a38ada535a3ddf1f609dbf3cb214a0
- pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlet@12.1.13
jetty-ee8-webapp-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/ee8/jetty-ee8-webapp/12.1.13/jetty-ee8-webapp-12.1.13.jar
- MD5: efd103d7e13ea13cd5b84eb6f3b7f467
- SHA1: 791103a0760e711ae25d40becd0dcd64a02998b8
- SHA256: 9c35ad71f60b943b7259862f0f7ecbb0a119c4d6404d911fcde488b2be095b9c
- pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.1.13
jetty-http-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-http/12.1.13/jetty-http-12.1.13.jar
- MD5: b206de5ac4de42b5dd1261f256ae9057
- SHA1: efb01d8b06210c12f76e8362a158802b00626c84
- SHA256: 3bb84bfdd0992453986a8f7422dbf55cf779a0a780ff8a68041bb6119fb997fd
- pkg:maven/org.eclipse.jetty/jetty-http@12.1.13
jetty-security-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-security/12.1.13/jetty-security-12.1.13.jar
- MD5: 143ae86be0e67296fd3354f21719227e
- SHA1: f42bee220f1a8ea7c738793731add4960a604477
- SHA256: 64b15214158097af40db345a31bb71cfe0d4a6c7c19cb59cd4c0a97245999ee8
- pkg:maven/org.eclipse.jetty/jetty-security@12.1.13
jetty-session-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-session/12.1.13/jetty-session-12.1.13.jar
- MD5: 058a4b618626e176e81ec1e4522ce88b
- SHA1: 33611cf54d23ff8427039f6459d05bf7b124b73c
- SHA256: 30ebd5d63895f97aad0d626a567b40552d4c2bd9978adedc46e7a23b4652f595
- pkg:maven/org.eclipse.jetty/jetty-session@12.1.13
jetty-util-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-util/12.1.13/jetty-util-12.1.13.jar
- MD5: db0b2f2b8bbca1c8f27f4f8f47386aa0
- SHA1: 0be3bfc956fad35b16070fb48952db4d8949a749
- SHA256: 3e408e60fe71a337979004fc4e47bfd3c08a931cf33b46b6a5dc4dbdd088c2fd
- pkg:maven/org.eclipse.jetty/jetty-util@12.1.13
jetty-xml-12.1.13.jar
- File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-xml/12.1.13/jetty-xml-12.1.13.jar
- MD5: db2f88b144c9ac24c5eb34a5329fc50b
- SHA1: 8d9e03e7cabf6127cde49e95f9d764cbb1d6ac62
- SHA256: ccf30ddde0326b9691818a3f797a1fc443a0633bf1b04989ed2387b7574f1e01
- pkg:maven/org.eclipse.jetty/jetty-xml@12.1.13

Identifiers

pkg:maven/org.eclipse.jetty/jetty-io@12.1.13 (Confidence:High)
cpe:2.3:a:eclipse:jetty:12.1.13:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:jetty:jetty:12.1.13:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:mortbay_jetty:jetty:12.1.13:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Jetty Server Artifact

License:

EPL-2.0 OR Apache-2.0
https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-server/12.1.13/jetty-server-12.1.13.jar
MD5: 8b072e45e35822eb3d3d26c3551d2114
SHA1: 445d0614d8169314e6c30ab0f5ce2c35b3cfeff3
SHA256:978265f1ac637c504b537f5d56e07d4a47e7c4bb0752d9dd66b79f5be754abfa
Referenced In Projects/Scopes:

waffle-jetty-jakarta:provided
waffle-jetty:provided

pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-servlet@12.1.13
pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlet@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jetty-server	High
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	jetty	Highest
Vendor	jar	package name	server	Highest
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-copyright	Copyright (c) 1995 Mort Bay Consulting Pty Ltd and others.	Low
Vendor	Manifest	bundle-docurl	https://jetty.org/	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jetty.server	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Jetty Project	High
Vendor	Manifest	url	https://jetty.org/	Low
Vendor	pom	artifactid	jetty-server	Highest
Vendor	pom	artifactid	jetty-server	Low
Vendor	pom	groupid	org.eclipse.jetty	Highest
Vendor	pom	name	Core :: Server	High
Vendor	pom	parent-artifactid	jetty-core	Low
Product	file	name	jetty-server	High
Product	jar	package name	eclipse	Highest
Product	jar	package name	jetty	Highest
Product	jar	package name	server	Highest
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-copyright	Copyright (c) 1995 Mort Bay Consulting Pty Ltd and others.	Low
Product	Manifest	bundle-docurl	https://jetty.org/	Low
Product	Manifest	Bundle-Name	Core :: Server	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jetty.server	Medium
Product	Manifest	url	https://jetty.org/	Low
Product	pom	artifactid	jetty-server	Highest
Product	pom	groupid	org.eclipse.jetty	Highest
Product	pom	name	Core :: Server	High
Product	pom	parent-artifactid	jetty-core	Medium
Version	file	version	12.1.13	High
Version	Manifest	Bundle-Version	12.1.13	High
Version	Manifest	Implementation-Version	12.1.13	High
Version	pom	version	12.1.13	Highest

Identifiers

pkg:maven/org.eclipse.jetty/jetty-server@12.1.13 (Confidence:High)
cpe:2.3:a:eclipse:jetty:12.1.13:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:jetty:jetty:12.1.13:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:jetty:jetty_http_server:12.1.13:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:mortbay_jetty:jetty:12.1.13:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Combined servlet api and schemas for use in JPMS and OSGi environments

License:

http://www.apache.org/licenses/LICENSE-2.0, https://www.eclipse.org/legal/epl-2.0/

File Path: /home/runner/.m2/repository/org/eclipse/jetty/toolchain/jetty-servlet-api/4.0.9/jetty-servlet-api-4.0.9.jar
MD5: 1726c1ac4398680da79bb5a9b8a03120
SHA1: e420683c1c3eae740461eb45cfea6ae7b3149511
SHA256:89916c0360ad8be8b0b6bab41d9f0d5d03b742abb5e13aeeac06817c14fdf037
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jetty-servlet-api	High
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://eclipse.org/jetty	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jetty.servlet-api	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse.org - Jetty	High
Vendor	Manifest	url	http://www.eclipse.org/jetty	Low
Vendor	pom	artifactid	jetty-servlet-api	Highest
Vendor	pom	artifactid	jetty-servlet-api	Low
Vendor	pom	groupid	org.eclipse.jetty.toolchain	Highest
Vendor	pom	name	Jetty :: Servlet API and Schemas for JPMS and OSGi	High
Vendor	pom	parent-artifactid	jetty-parent	Low
Vendor	pom	parent-groupid	org.eclipse.jetty	Medium
Product	file	name	jetty-servlet-api	High
Product	jar	package name	http	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://eclipse.org/jetty	Low
Product	Manifest	Bundle-Name	Eclipse Jetty Servlet API and Schemas for JPMS and OSGi	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Product	Manifest	bundle-symbolicname	org.eclipse.jetty.servlet-api	Medium
Product	Manifest	url	http://www.eclipse.org/jetty	Low
Product	pom	artifactid	jetty-servlet-api	Highest
Product	pom	groupid	org.eclipse.jetty.toolchain	Highest
Product	pom	name	Jetty :: Servlet API and Schemas for JPMS and OSGi	High
Product	pom	parent-artifactid	jetty-parent	Medium
Product	pom	parent-groupid	org.eclipse.jetty	Medium
Version	file	version	4.0.9	High
Version	Manifest	Bundle-Version	4.0.9	High
Version	Manifest	Implementation-Version	4.0.9	High
Version	pom	parent-version	4.0.9	Low
Version	pom	version	4.0.9	Highest

Identifiers

pkg:maven/org.eclipse.jetty.toolchain/jetty-servlet-api@4.0.9 (Confidence:High)

Description:

Java Native Access

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar
MD5: cf327da3e9cf5a5d77c8a43540320929
SHA1: ca303052cd617c1af2e2c8d344c98a706fb63143
SHA256:4fb141dd8ef6b0585ffceea4bc49602fbc6312fa977e2c488794ea3e6aafecae
Referenced In Projects/Scopes:

waffle-bom-jakarta:compile
waffle-bom:compile
waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

pkg:maven/com.github.waffle/waffle-bom-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jna	High
Vendor	jar	package name	jna	Highest
Vendor	jar	package name	native	Highest
Vendor	jar	package name	sun	Highest
Vendor	jar (hint)	package name	oracle	Highest
Vendor	Manifest	automatic-module-name	com.sun.jna	Medium
Vendor	Manifest	bundle-activationpolicy	lazy	Low
Vendor	Manifest	bundle-category	jni	Low
Vendor	Manifest	bundle-nativecode	com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win32, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win32, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win32, com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win, com/sun/jna/w32ce-arm/jnidispatch.dll; processor=arm;osname=wince, com/sun/jna/sunos-x86/libjnidispatch.so; processor=x86;osname=sunos, com/sun/jna/sunos-x86-64/libjnidispatch.so; processor=x86-64;osname=sunos, com/sun/jna/sunos-sparc/libjnidispatch.so; processor=sparc;osname=sunos, com/sun/jna/sunos-sparcv9/libjnidispatch.so; processor=sparcv9;osname=sunos, com/sun/jna/aix-ppc/libjnidispatch.a; processor=ppc;osname=aix, com/sun/jna/aix-ppc64/libjnidispatch.a; processor=ppc64;osname=aix, com/sun/jna/linux-ppc/libjnidispatch.so; processor=ppc;osname=linux, com/sun/jna/linux-ppc64/libjnidispatch.so; processor=ppc64;osname=linux, com/sun/jna/linux-ppc64le/libjnidispatch.so; processor=ppc64le;osname=linux, com/sun/jna/linux-x86/libjnidispatch.so; processor=x86;osname=linux, com/sun/jna/linux-x86-64/libjnidispatch.so; processor=x86-64;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm_le;osname=linux, com/sun/jna/linux-armel/libjnidispatch.so; processor=armel;osname=linux, com/sun/jna/linux-aarch64/libjnidispatch.so; processor=aarch64;osname=linux, com/sun/jna/linux-ia64/libjnidispatch.so; processor=ia64;osname=linux, com/sun/jna/linux-sparcv9/libjnidispatch.so; processor=sparcv9;osname=linux, com/sun/jna/linux-mips64el/libjnidispatch.so; processor=mips64el;osname=linux, com/sun/jna/linux-s390x/libjnidispatch.so; processor=S390x;osname=linux, com/sun/jna/linux-loongarch64/libjnidispatch.so; processor=loongarch64;osname=linux, com/sun/jna/linux-riscv64/libjnidispatch.so; processor=riscv64;osname=linux, com/sun/jna/dragonflybsd-x86-64/libjnidispatch.so; processor=x86-64;osname=dragonflybsd, com/sun/jna/freebsd-x86/libjnidispatch.so; processor=x86;osname=freebsd, com/sun/jna/freebsd-x86-64/libjnidispatch.so; processor=x86-64;osname=freebsd, com/sun/jna/freebsd-aarch64/libjnidispatch.so; processor=aarch64;osname=freebsd, com/sun/jna/freebsd-ppc64le/libjnidispatch.so; processor=ppc64le;osname=freebsd, com/sun/jna/freebsd-ppc64/libjnidispatch.so; processor=ppc64;osname=freebsd, com/sun/jna/openbsd-x86/libjnidispatch.so; processor=x86;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=x86-64;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=sparcv9;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=aarch64;osname=openbsd, com/sun/jna/darwin-ppc/libjnidispatch.jnilib; osname=macosx;processor=ppc, com/sun/jna/darwin-ppc64/libjnidispatch.jnilib; osname=macosx;processor=ppc64, com/sun/jna/darwin-x86/libjnidispatch.jnilib; osname=macosx;processor=x86, com/sun/jna/darwin-x86-64/libjnidispatch.jnilib; osname=macosx;processor=x86-64, com/sun/jna/darwin-aarch64/libjnidispatch.jnilib; osname=macosx;processor=aarch64	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.6	Low
Vendor	Manifest	bundle-symbolicname	com.sun.jna	Medium
Vendor	Manifest	Implementation-Vendor	JNA Development Team	High
Vendor	Manifest	specification-vendor	JNA Development Team	Low
Vendor	pom	artifactid	jna	Highest
Vendor	pom	artifactid	jna	Low
Vendor	pom	developer email	mblaesing@doppel-helix.eu	Low
Vendor	pom	developer id	twall	Medium
Vendor	pom	developer name	Matthias Bläsing	Medium
Vendor	pom	developer name	Timothy Wall	Medium
Vendor	pom	groupid	net.java.dev.jna	Highest
Vendor	pom	name	Java Native Access	High
Vendor	pom	url	java-native-access/jna	Highest
Product	file	name	jna	High
Product	jar	package name	jna	Highest
Product	jar	package name	library	Highest
Product	jar	package name	native	Highest
Product	jar	package name	sun	Highest
Product	jar	package name	win32	Highest
Product	Manifest	automatic-module-name	com.sun.jna	Medium
Product	Manifest	bundle-activationpolicy	lazy	Low
Product	Manifest	bundle-category	jni	Low
Product	Manifest	Bundle-Name	jna	Medium
Product	Manifest	bundle-nativecode	com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win32, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win32, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win32, com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win, com/sun/jna/w32ce-arm/jnidispatch.dll; processor=arm;osname=wince, com/sun/jna/sunos-x86/libjnidispatch.so; processor=x86;osname=sunos, com/sun/jna/sunos-x86-64/libjnidispatch.so; processor=x86-64;osname=sunos, com/sun/jna/sunos-sparc/libjnidispatch.so; processor=sparc;osname=sunos, com/sun/jna/sunos-sparcv9/libjnidispatch.so; processor=sparcv9;osname=sunos, com/sun/jna/aix-ppc/libjnidispatch.a; processor=ppc;osname=aix, com/sun/jna/aix-ppc64/libjnidispatch.a; processor=ppc64;osname=aix, com/sun/jna/linux-ppc/libjnidispatch.so; processor=ppc;osname=linux, com/sun/jna/linux-ppc64/libjnidispatch.so; processor=ppc64;osname=linux, com/sun/jna/linux-ppc64le/libjnidispatch.so; processor=ppc64le;osname=linux, com/sun/jna/linux-x86/libjnidispatch.so; processor=x86;osname=linux, com/sun/jna/linux-x86-64/libjnidispatch.so; processor=x86-64;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm_le;osname=linux, com/sun/jna/linux-armel/libjnidispatch.so; processor=armel;osname=linux, com/sun/jna/linux-aarch64/libjnidispatch.so; processor=aarch64;osname=linux, com/sun/jna/linux-ia64/libjnidispatch.so; processor=ia64;osname=linux, com/sun/jna/linux-sparcv9/libjnidispatch.so; processor=sparcv9;osname=linux, com/sun/jna/linux-mips64el/libjnidispatch.so; processor=mips64el;osname=linux, com/sun/jna/linux-s390x/libjnidispatch.so; processor=S390x;osname=linux, com/sun/jna/linux-loongarch64/libjnidispatch.so; processor=loongarch64;osname=linux, com/sun/jna/linux-riscv64/libjnidispatch.so; processor=riscv64;osname=linux, com/sun/jna/dragonflybsd-x86-64/libjnidispatch.so; processor=x86-64;osname=dragonflybsd, com/sun/jna/freebsd-x86/libjnidispatch.so; processor=x86;osname=freebsd, com/sun/jna/freebsd-x86-64/libjnidispatch.so; processor=x86-64;osname=freebsd, com/sun/jna/freebsd-aarch64/libjnidispatch.so; processor=aarch64;osname=freebsd, com/sun/jna/freebsd-ppc64le/libjnidispatch.so; processor=ppc64le;osname=freebsd, com/sun/jna/freebsd-ppc64/libjnidispatch.so; processor=ppc64;osname=freebsd, com/sun/jna/openbsd-x86/libjnidispatch.so; processor=x86;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=x86-64;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=sparcv9;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=aarch64;osname=openbsd, com/sun/jna/darwin-ppc/libjnidispatch.jnilib; osname=macosx;processor=ppc, com/sun/jna/darwin-ppc64/libjnidispatch.jnilib; osname=macosx;processor=ppc64, com/sun/jna/darwin-x86/libjnidispatch.jnilib; osname=macosx;processor=x86, com/sun/jna/darwin-x86-64/libjnidispatch.jnilib; osname=macosx;processor=x86-64, com/sun/jna/darwin-aarch64/libjnidispatch.jnilib; osname=macosx;processor=aarch64	Low
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.6	Low
Product	Manifest	bundle-symbolicname	com.sun.jna	Medium
Product	Manifest	Implementation-Title	com.sun.jna	High
Product	Manifest	specification-title	Java Native Access (JNA)	Medium
Product	pom	artifactid	jna	Highest
Product	pom	developer email	mblaesing@doppel-helix.eu	Low
Product	pom	developer id	twall	Low
Product	pom	developer name	Matthias Bläsing	Low
Product	pom	developer name	Timothy Wall	Low
Product	pom	groupid	net.java.dev.jna	Highest
Product	pom	name	Java Native Access	High
Product	pom	url	java-native-access/jna	High
Version	file	version	5.19.1	High
Version	Manifest	Bundle-Version	5.19.1	High
Version	pom	version	5.19.1	Highest

Identifiers

pkg:maven/net.java.dev.jna/jna@5.19.1 (Confidence:High)

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-aarch64/jnidispatch.dll
MD5: 302945a811fd8e21bcdd5226c73b6f74
SHA1: 6b05e299ff2b3eb3b7b7aeac44263f715693607c
SHA256:b8f98be314234cf12b5b46c29652f70c0f6abb93ae19b63d3fe2692062aa699d
Referenced In Projects/Scopes:

waffle-bom-jakarta:compile
waffle-bom:compile
waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jnidispatch	High
Product	file	name	jnidispatch	High

Identifiers

None

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86-64/jnidispatch.dll
MD5: 2d2475f1f026dd54e9f3e787ae4f81da
SHA1: 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA256:5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
Referenced In Projects/Scopes:

waffle-bom-jakarta:compile
waffle-bom:compile
waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jnidispatch	High
Product	file	name	jnidispatch	High

Identifiers

None

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86/jnidispatch.dll
MD5: 0caa1ef75a807f9dde05084fa2219a5c
SHA1: 2f5e1cd82cde192905c7510ce99037b67d980640
SHA256:752d597cee7e95cb517327146bf42f124c0d6c0bc48b3ecc3b1b3b0531a52f44
Referenced In Projects/Scopes:

waffle-bom-jakarta:compile
waffle-bom:compile
waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jnidispatch	High
Product	file	name	jnidispatch	High

Identifiers

None

Description:

Java Native Access Platform

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna-platform/5.19.1/jna-platform-5.19.1.jar
MD5: 1d97b6103a9b3b7ddb671908683f4566
SHA1: d1e54d9231da5ca3fa730d52960deaa555475468
SHA256:3b3864f5b449e9c3c24b16861524b622b086563f44e0cd8384c8efc5a6052f82
Referenced In Projects/Scopes:

waffle-bom-jakarta:compile
waffle-bom:compile
waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

pkg:maven/com.github.waffle/waffle-bom-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jna-platform	High
Vendor	jar	package name	jna	Highest
Vendor	jar	package name	platform	Highest
Vendor	jar	package name	sun	Highest
Vendor	jar (hint)	package name	oracle	Highest
Vendor	Manifest	automatic-module-name	com.sun.jna.platform	Medium
Vendor	Manifest	bundle-category	jni	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.4	Low
Vendor	Manifest	bundle-symbolicname	com.sun.jna.platform	Medium
Vendor	Manifest	Implementation-Vendor	JNA Development Team	High
Vendor	Manifest	specification-vendor	JNA Development Team	Low
Vendor	pom	artifactid	jna-platform	Highest
Vendor	pom	artifactid	jna-platform	Low
Vendor	pom	developer email	mblaesing@doppel-helix.eu	Low
Vendor	pom	developer id	twall	Medium
Vendor	pom	developer name	Matthias Bläsing	Medium
Vendor	pom	developer name	Timothy Wall	Medium
Vendor	pom	groupid	net.java.dev.jna	Highest
Vendor	pom	name	Java Native Access Platform	High
Vendor	pom	url	java-native-access/jna	Highest
Product	file	name	jna-platform	High
Product	jar	package name	jna	Highest
Product	jar	package name	platform	Highest
Product	jar	package name	sun	Highest
Product	Manifest	automatic-module-name	com.sun.jna.platform	Medium
Product	Manifest	bundle-category	jni	Low
Product	Manifest	Bundle-Name	jna-platform	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.4	Low
Product	Manifest	bundle-symbolicname	com.sun.jna.platform	Medium
Product	Manifest	Implementation-Title	com.sun.jna	High
Product	Manifest	specification-title	Java Native Access (JNA)	Medium
Product	pom	artifactid	jna-platform	Highest
Product	pom	developer email	mblaesing@doppel-helix.eu	Low
Product	pom	developer id	twall	Low
Product	pom	developer name	Matthias Bläsing	Low
Product	pom	developer name	Timothy Wall	Low
Product	pom	groupid	net.java.dev.jna	Highest
Product	pom	name	Java Native Access Platform	High
Product	pom	url	java-native-access/jna	High
Version	file	version	5.19.1	High
Version	Manifest	Bundle-Version	5.19.1	High
Version	pom	version	5.19.1	Highest

Identifiers

pkg:maven/net.java.dev.jna/jna-platform@5.19.1 (Confidence:High)

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Projects/Scopes:

waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/org.junit.jupiter/junit-jupiter-engine@6.1.3
pkg:maven/org.springframework/spring-core@7.0.9

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jspecify	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	jspecify	Highest
Vendor	Manifest	bundle-docurl	https://jspecify.dev/docs/start-here	Low
Vendor	Manifest	bundle-symbolicname	org.jspecify.jspecify	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	jspecify	Highest
Vendor	pom	artifactid	jspecify	Low
Vendor	pom	developer email	kevinb9n@gmail.com	Low
Vendor	pom	developer id	kevinb9n	Medium
Vendor	pom	developer name	Kevin Bourrillion	Medium
Vendor	pom	groupid	org.jspecify	Highest
Vendor	pom	name	JSpecify annotations	High
Vendor	pom	url	http://jspecify.org/	Highest
Product	file	name	jspecify	High
Product	jar	package name	annotations	Highest
Product	jar	package name	jspecify	Highest
Product	Manifest	bundle-docurl	https://jspecify.dev/docs/start-here	Low
Product	Manifest	Bundle-Name	JSpecify annotations	Medium
Product	Manifest	bundle-symbolicname	org.jspecify.jspecify	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	jspecify	Highest
Product	pom	developer email	kevinb9n@gmail.com	Low
Product	pom	developer id	kevinb9n	Low
Product	pom	developer name	Kevin Bourrillion	Low
Product	pom	groupid	org.jspecify	Highest
Product	pom	name	JSpecify annotations	High
Product	pom	url	http://jspecify.org/	Medium
Version	file	version	1.0.0	High
Version	Manifest	Bundle-Version	1.0.0	High
Version	Manifest	Implementation-Version	1.0.0	High
Version	pom	version	1.0.0	Highest

Identifiers

pkg:maven/org.jspecify/jspecify@1.0.0 (Confidence:High)

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.1/jspecify-1.0.1.jar
MD5: d4fe1ea4d953b66fcb1d6043c22bffcf
SHA1: 3d60fd98eb8ade73004f4195c37b6317e02cf3d7
SHA256:070d75f261fe4c5b8202508366715f7f2d4660f88c8ef7e6d3575e48c9683b66
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile

pkg:maven/org.junit.jupiter/junit-jupiter-engine@6.0.3

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jspecify	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	jspecify	Highest
Vendor	Manifest	bundle-docurl	https://jspecify.dev/docs/start-here	Low
Vendor	Manifest	bundle-symbolicname	org.jspecify.jspecify	Medium
Vendor	pom	artifactid	jspecify	Highest
Vendor	pom	artifactid	jspecify	Low
Vendor	pom	developer email	cpovirk@google.com	Low
Vendor	pom	developer email	dpb@google.com	Low
Vendor	pom	developer email	kevinb9n@gmail.com	Low
Vendor	pom	developer id	cpovirk	Medium
Vendor	pom	developer id	kevinb9n	Medium
Vendor	pom	developer id	netdpb	Medium
Vendor	pom	developer name	Chris Povirk	Medium
Vendor	pom	developer name	David P. Baker	Medium
Vendor	pom	developer name	Kevin Bourrillion	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	groupid	org.jspecify	Highest
Vendor	pom	name	JSpecify annotations	High
Vendor	pom	url	https://jspecify.dev/	Highest
Product	file	name	jspecify	High
Product	jar	package name	annotations	Highest
Product	jar	package name	jspecify	Highest
Product	Manifest	bundle-docurl	https://jspecify.dev/docs/start-here	Low
Product	Manifest	Bundle-Name	JSpecify annotations	Medium
Product	Manifest	bundle-symbolicname	org.jspecify.jspecify	Medium
Product	pom	artifactid	jspecify	Highest
Product	pom	developer email	cpovirk@google.com	Low
Product	pom	developer email	dpb@google.com	Low
Product	pom	developer email	kevinb9n@gmail.com	Low
Product	pom	developer id	cpovirk	Low
Product	pom	developer id	kevinb9n	Low
Product	pom	developer id	netdpb	Low
Product	pom	developer name	Chris Povirk	Low
Product	pom	developer name	David P. Baker	Low
Product	pom	developer name	Kevin Bourrillion	Low
Product	pom	developer org	Google	Low
Product	pom	groupid	org.jspecify	Highest
Product	pom	name	JSpecify annotations	High
Product	pom	url	https://jspecify.dev/	Medium
Version	file	version	1.0.1	High
Version	Manifest	Bundle-Version	1.0.1	High
Version	Manifest	Implementation-Version	1.0.1	High
Version	pom	version	1.0.1	Highest

Identifiers

pkg:maven/org.jspecify/jspecify@1.0.1 (Confidence:High)
cpe:2.3:a:google:gmail:1.0.1:*:*:*:*:*:*:* (Confidence:Low)

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Projects/Scopes:

waffle-bom-jakarta:provided
waffle-bom:provided
waffle-demo-filter-jakarta:provided
waffle-demo-filter:provided
waffle-demo-form-jakarta:provided
waffle-demo-form:provided
waffle-demo-jaas-jakarta:provided
waffle-demo-jaas:provided
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-parent-jakarta:provided
waffle-demo-parent:provided
waffle-demo-spring-boot-filter2:provided
waffle-demo-spring-boot-filter3:provided
waffle-demo-spring-boot-filter4:provided
waffle-demo-spring-filter-jakarta:provided
waffle-demo-spring-filter:provided
waffle-demo-spring-form-jakarta:provided
waffle-demo-spring-form:provided
waffle-distro-jakarta:provided
waffle-distro:provided
waffle-jetty-jakarta:provided
waffle-jetty:provided
waffle-jna-jakarta:provided
waffle-jna:provided
waffle-shiro-jakarta:provided
waffle-shiro:provided
waffle-spring-boot-autoconfigure2:provided
waffle-spring-boot-autoconfigure3:provided
waffle-spring-boot-autoconfigure4:provided
waffle-spring-boot-starter2:provided
waffle-spring-boot-starter3:provided
waffle-spring-boot-starter4:provided
waffle-spring-boot2:provided
waffle-spring-boot3:provided
waffle-spring-boot4:provided
waffle-spring-security5:provided
waffle-spring-security6:provided
waffle-spring-security7:provided
waffle-tests-jakarta:provided
waffle-tests:provided
waffle-tomcat10:provided
waffle-tomcat11:provided
waffle-tomcat9:provided
waffle:provided

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

Description:

JUL to SLF4J bridge

File Path: /home/runner/.m2/repository/org/slf4j/jul-to-slf4j/1.7.36/jul-to-slf4j-1.7.36.jar
MD5: 2a3fe73e6cafe8f102facaf2dd65353f
SHA1: ed46d81cef9c412a88caef405b58f93a678ff2ca
SHA256:9e641fb142c5f0b0623d6222c09ea87523a41bf6bed48ac79940724010b989de
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile

pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jul-to-slf4j	High
Vendor	jar	package name	bridge	Highest
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Vendor	Manifest	bundle-symbolicname	jul.to.slf4j	Medium
Vendor	pom	artifactid	jul-to-slf4j	Highest
Vendor	pom	artifactid	jul-to-slf4j	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	JUL to SLF4J bridge	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	jul-to-slf4j	High
Product	jar	package name	bridge	Highest
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	Bundle-Name	jul-to-slf4j	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Product	Manifest	bundle-symbolicname	jul.to.slf4j	Medium
Product	pom	artifactid	jul-to-slf4j	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	JUL to SLF4J bridge	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	1.7.36	High
Version	Manifest	Bundle-Version	1.7.36	High
Version	Manifest	Implementation-Version	1.7.36	High
Version	pom	version	1.7.36	Highest

Identifiers

pkg:maven/org.slf4j/jul-to-slf4j@1.7.36 (Confidence:High)

Description:

JUL to SLF4J bridge

License:

https://opensource.org/license/mit

File Path: /home/runner/.m2/repository/org/slf4j/jul-to-slf4j/2.0.18/jul-to-slf4j-2.0.18.jar
MD5: f339bf7648049b2105e180cab6c45c9d
SHA1: 79739c98001d5c9d078d087d5a348ec9e474ec8f
SHA256:cbb7d1aaaa9e871eb1a06594abd911bf97027152976edf1edc315be75239204e
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-security@4.1.1
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jul-to-slf4j	High
Vendor	jar	package name	bridge	Highest
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.slf4j.org	Low
Vendor	Manifest	bundle-symbolicname	jul.to.slf4j	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	jul-to-slf4j	Highest
Vendor	pom	artifactid	jul-to-slf4j	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	JUL to SLF4J bridge	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	jul-to-slf4j	High
Product	jar	package name	bridge	Highest
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.slf4j.org	Low
Product	Manifest	Bundle-Name	JUL to SLF4J bridge	Medium
Product	Manifest	bundle-symbolicname	jul.to.slf4j	Medium
Product	Manifest	Implementation-Title	jul-to-slf4j	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	jul-to-slf4j	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	JUL to SLF4J bridge	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	2.0.18	High
Version	Manifest	Bundle-Version	2.0.18	High
Version	Manifest	Implementation-Version	2.0.18	High
Version	pom	version	2.0.18	Highest

Identifiers

pkg:maven/org.slf4j/jul-to-slf4j@2.0.18 (Confidence:High)

Description:

JUL to SLF4J bridge

License:

https://opensource.org/license/mit

File Path: /home/runner/.m2/repository/org/slf4j/jul-to-slf4j/2.0.19/jul-to-slf4j-2.0.19.jar
MD5: e0221ada87fa670a95f314b1449348e9
SHA1: 8b5227598a10e12883a5d8ad863c28b582294ac9
SHA256:a5764fbd2f0053399ef75d40653c4e7c97e733b45676946b0a072416fc56ff30
Referenced In Projects/Scopes:

waffle-distro-jakarta:runtime
waffle-distro:runtime

pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jul-to-slf4j	High
Vendor	jar	package name	bridge	Highest
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.slf4j.org	Low
Vendor	Manifest	bundle-symbolicname	jul.to.slf4j	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	jul-to-slf4j	Highest
Vendor	pom	artifactid	jul-to-slf4j	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	JUL to SLF4J bridge	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	jul-to-slf4j	High
Product	jar	package name	bridge	Highest
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.slf4j.org	Low
Product	Manifest	Bundle-Name	JUL to SLF4J bridge	Medium
Product	Manifest	bundle-symbolicname	jul.to.slf4j	Medium
Product	Manifest	Implementation-Title	jul-to-slf4j	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	jul-to-slf4j	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	JUL to SLF4J bridge	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	2.0.19	High
Version	Manifest	Bundle-Version	2.0.19	High
Version	Manifest	Implementation-Version	2.0.19	High
Version	pom	version	2.0.19	Highest

Identifiers

pkg:maven/org.slf4j/jul-to-slf4j@2.0.19 (Confidence:High)

Description:

The logging API of the Log4j project.
    Library and application code can log through this API.
    It contains a simple built-in implementation (`SimpleLogger`) for trivial use cases.
    Production applications are recommended to use Log4j API in combination with a fully-fledged implementation, such as Log4j Core.

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/logging/log4j/log4j-api/2.26.1/log4j-api-2.26.1.jar
MD5: 8ed35fc9ea449bc9e21a8139842d6233
SHA1: b9864ed8d0c01f65f3b0bf70f1447e5cc1b49c24
SHA256:f1810a4704ccce019d02bba029dc02a4f2ac0c997f647b465e7d409c1927f822
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter2:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-security@4.1.1
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	log4j-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	log4j	Highest
Vendor	jar	package name	logging	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	simple	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-activationpolicy	lazy	Low
Vendor	Manifest	bundle-symbolicname	org.apache.logging.log4j.api	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="org.apache.logging.log4j.util.PropertySource";effective:=active,osgi.serviceloader;osgi.serviceloader="org.apache.logging.log4j.util.PropertySource";register:="org.apache.logging.log4j.util.EnvironmentPropertySource",osgi.serviceloader;osgi.serviceloader="org.apache.logging.log4j.util.PropertySource";register:="org.apache.logging.log4j.util.SystemPropertiesPropertySource"	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	log4j-api	Highest
Vendor	pom	artifactid	log4j-api	Low
Vendor	pom	groupid	org.apache.logging.log4j	Highest
Vendor	pom	name	Apache Log4j API	High
Vendor	pom	parent-artifactid	log4j	Low
Vendor	pom	url	https://logging.apache.org/log4j/2.x/	Highest
Product	file	name	log4j-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	log4j	Highest
Product	jar	package name	logging	Highest
Product	jar	package name	org	Highest
Product	jar	package name	simple	Highest
Product	jar	package name	util	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-activationpolicy	lazy	Low
Product	Manifest	Bundle-Name	Apache Log4j API	Medium
Product	Manifest	bundle-symbolicname	org.apache.logging.log4j.api	Medium
Product	Manifest	Implementation-Title	Apache Log4j API	High
Product	Manifest	multi-release	true	Low
Product	Manifest	provide-capability	osgi.service;objectClass:List="org.apache.logging.log4j.util.PropertySource";effective:=active,osgi.serviceloader;osgi.serviceloader="org.apache.logging.log4j.util.PropertySource";register:="org.apache.logging.log4j.util.EnvironmentPropertySource",osgi.serviceloader;osgi.serviceloader="org.apache.logging.log4j.util.PropertySource";register:="org.apache.logging.log4j.util.SystemPropertiesPropertySource"	Low
Product	Manifest	specification-title	Apache Log4j API	Medium
Product	pom	artifactid	log4j-api	Highest
Product	pom	groupid	org.apache.logging.log4j	Highest
Product	pom	name	Apache Log4j API	High
Product	pom	parent-artifactid	log4j	Medium
Product	pom	url	https://logging.apache.org/log4j/2.x/	Medium
Version	file	version	2.26.1	High
Version	Manifest	Bundle-Version	2.26.1	High
Version	Manifest	Implementation-Version	2.26.1	High
Version	pom	version	2.26.1	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.logging.log4j/log4j-api@2.26.1 (Confidence:High)
cpe:2.3:a:apache:log4j:2.26.1:*:*:*:*:*:*:* (Confidence:Highest)

Description:

logback-core module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

File Path: /home/runner/.m2/repository/ch/qos/logback/logback-core/1.5.34/logback-core-1.5.34.jar
MD5: ef459237a22ab546dd001ff612dce80d
SHA1: 378692f76c337b3325c15bffb89e013dc1f897b4
SHA256:42eda264c0c650c2bec59e66151a88b708a8663dc1b49d788202d53e78b8caae
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile

pkg:maven/ch.qos.logback/logback-classic@1.6.3
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	logback-core	High
Vendor	jar	package name	ch	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	logback	Highest
Vendor	jar	package name	qos	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.qos.ch	Low
Vendor	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Vendor	Manifest	Implementation-Vendor	QOS.ch	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Vendor	Manifest	specification-vendor	QOS.ch	Low
Vendor	pom	artifactid	logback-core	Highest
Vendor	pom	artifactid	logback-core	Low
Vendor	pom	groupid	ch.qos.logback	Highest
Vendor	pom	name	Logback Core Module	High
Vendor	pom	parent-artifactid	logback-parent	Low
Product	file	name	logback-core	High
Product	jar	package name	21	Highest
Product	jar	package name	ch	Highest
Product	jar	package name	core	Highest
Product	jar	package name	logback	Highest
Product	jar	package name	qos	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.qos.ch	Low
Product	Manifest	Bundle-Name	Logback Core Module	Medium
Product	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Product	Manifest	Implementation-Title	Logback Core Module	High
Product	Manifest	multi-release	true	Low
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Product	Manifest	specification-title	Logback Core Module	Medium
Product	pom	artifactid	logback-core	Highest
Product	pom	groupid	ch.qos.logback	Highest
Product	pom	name	Logback Core Module	High
Product	pom	parent-artifactid	logback-parent	Medium
Version	file	version	1.5.34	High
Version	Manifest	Bundle-Version	1.5.34	High
Version	Manifest	Implementation-Version	1.5.34	High
Version	pom	version	1.5.34	Highest

Related Dependencies

Identifiers

pkg:maven/ch.qos.logback/logback-core@1.5.34 (Confidence:High)
cpe:2.3:a:qos:logback:1.5.34:*:*:*:*:*:*:* (Confidence:Highest)

Description:

logback-core module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

File Path: /home/runner/.m2/repository/ch/qos/logback/logback-core/1.5.38/logback-core-1.5.38.jar
MD5: a065b3893602a19f6f393a42c499c198
SHA1: 7b1d133b29bf42ff268cf3f71d1308b80480fb8d
SHA256:a855a0fc97b1d06f4efb1c3bba5ebd0eb508d8b58e68e89e4bbc23a85135c883
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile

pkg:maven/ch.qos.logback/logback-classic@1.6.3
pkg:maven/org.springframework.boot/spring-boot-starter-security@4.1.1
pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	logback-core	High
Vendor	jar	package name	ch	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	logback	Highest
Vendor	jar	package name	qos	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.qos.ch	Low
Vendor	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Vendor	Manifest	Implementation-Vendor	QOS.ch	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Vendor	Manifest	specification-vendor	QOS.ch	Low
Vendor	pom	artifactid	logback-core	Highest
Vendor	pom	artifactid	logback-core	Low
Vendor	pom	groupid	ch.qos.logback	Highest
Vendor	pom	name	Logback Core Module	High
Vendor	pom	parent-artifactid	logback-parent	Low
Product	file	name	logback-core	High
Product	jar	package name	ch	Highest
Product	jar	package name	core	Highest
Product	jar	package name	logback	Highest
Product	jar	package name	qos	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.qos.ch	Low
Product	Manifest	Bundle-Name	Logback Core Module	Medium
Product	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Product	Manifest	Implementation-Title	Logback Core Module	High
Product	Manifest	multi-release	true	Low
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Product	Manifest	specification-title	Logback Core Module	Medium
Product	pom	artifactid	logback-core	Highest
Product	pom	groupid	ch.qos.logback	Highest
Product	pom	name	Logback Core Module	High
Product	pom	parent-artifactid	logback-parent	Medium
Version	file	version	1.5.38	High
Version	Manifest	Bundle-Version	1.5.38	High
Version	Manifest	Implementation-Version	1.5.38	High
Version	pom	version	1.5.38	Highest

Related Dependencies

Identifiers

pkg:maven/ch.qos.logback/logback-core@1.5.38 (Confidence:High)
cpe:2.3:a:qos:logback:1.5.38:*:*:*:*:*:*:* (Confidence:Highest)

Description:

logback-core module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

File Path: /home/runner/.m2/repository/ch/qos/logback/logback-core/1.6.3/logback-core-1.6.3.jar
MD5: 6d741138bccf87bb512572c44cc7f43f
SHA1: ae9a279c723035307735fc4daf527a9076ea3f77
SHA256:a6967a28c8b086dee75a694d2f6fb8830c71153539866d7d8af065c9b6df91e0
Referenced In Projects/Scopes:

waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:compile
waffle-demo-mixed-post-jakarta:compile
waffle-demo-mixed-post:compile
waffle-demo-mixed:compile
waffle-demo-negotiate-jakarta:compile
waffle-demo-negotiate:compile
waffle-demo-parent-jakarta:compile
waffle-demo-parent:compile
waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile

pkg:maven/ch.qos.logback/logback-classic@1.6.3
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	logback-core	High
Vendor	jar	package name	ch	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	logback	Highest
Vendor	jar	package name	qos	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.qos.ch	Low
Vendor	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Vendor	Manifest	Implementation-Vendor	QOS.ch	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Vendor	Manifest	specification-vendor	QOS.ch	Low
Vendor	pom	artifactid	logback-core	Highest
Vendor	pom	artifactid	logback-core	Low
Vendor	pom	groupid	ch.qos.logback	Highest
Vendor	pom	name	Logback Core Module	High
Vendor	pom	parent-artifactid	logback-parent	Low
Product	file	name	logback-core	High
Product	jar	package name	ch	Highest
Product	jar	package name	core	Highest
Product	jar	package name	logback	Highest
Product	jar	package name	qos	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.qos.ch	Low
Product	Manifest	Bundle-Name	Logback Core Module	Medium
Product	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Product	Manifest	Implementation-Title	Logback Core Module	High
Product	Manifest	multi-release	true	Low
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Product	Manifest	specification-title	Logback Core Module	Medium
Product	pom	artifactid	logback-core	Highest
Product	pom	groupid	ch.qos.logback	Highest
Product	pom	name	Logback Core Module	High
Product	pom	parent-artifactid	logback-parent	Medium
Version	file	version	1.6.3	High
Version	Manifest	Bundle-Version	1.6.3	High
Version	Manifest	Implementation-Version	1.6.3	High
Version	pom	version	1.6.3	Highest

Related Dependencies

Identifiers

pkg:maven/ch.qos.logback/logback-core@1.6.3 (Confidence:High)
cpe:2.3:a:qos:logback:1.6.3:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Module containing common code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/io/micrometer/micrometer-commons/1.15.12/micrometer-commons-1.15.12.jar
MD5: 8172f342d797138ec7a1a20e0332568c
SHA1: eb539638d48571fa6ce4ea3eb8417cab37a63438
SHA256:4b779cf7acb0534bb1f8e964f25200037ecb3944368f859a630fa637d6d5d7c0
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-form-jakarta:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile
waffle-spring-security6:compile

pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework/spring-context@6.2.19

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	micrometer-commons	High
Vendor	jar	package name	common	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	micrometer	Highest
Vendor	Manifest	automatic-module-name	micrometer.commons	Medium
Vendor	Manifest	branch	HEAD	Low
Vendor	Manifest	build-date	2026-06-08_05:57:33	Low
Vendor	Manifest	build-date-utc	2026-06-08T05:57:33.437169978Z	Low
Vendor	Manifest	build-host	320eea4f7654	Low
Vendor	Manifest	build-job	deploy	Low
Vendor	Manifest	build-number	70801	Low
Vendor	Manifest	build-timezone	Etc/UTC	Low
Vendor	Manifest	build-url	https://circleci.com/gh/micrometer-metrics/micrometer/70801	Low
Vendor	Manifest	built-os	Linux	Low
Vendor	Manifest	built-status	release	Low
Vendor	Manifest	bundle-symbolicname	micrometer-commons	Medium
Vendor	Manifest	change	dc2e5e2	Low
Vendor	Manifest	full-change	dc2e5e2ea33a41a271b4b40e796ef39f1ed056af	Low
Vendor	Manifest	module-email	tludwig@vmware.com	Low
Vendor	Manifest	module-origin	micrometer-metrics/micrometer.git	Low
Vendor	Manifest	module-owner	tludwig@vmware.com	Low
Vendor	Manifest	module-source	/micrometer-commons	Low
Vendor	pom	artifactid	micrometer-commons	Highest
Vendor	pom	artifactid	micrometer-commons	Low
Vendor	pom	developer email	tludwig@vmware.com	Low
Vendor	pom	developer id	shakuzen	Medium
Vendor	pom	developer name	Tommy Ludwig	Medium
Vendor	pom	groupid	io.micrometer	Highest
Vendor	pom	name	micrometer-commons	High
Vendor	pom	url	micrometer-metrics/micrometer	Highest
Product	file	name	micrometer-commons	High
Product	jar	package name	common	Highest
Product	jar	package name	io	Highest
Product	jar	package name	micrometer	Highest
Product	Manifest	automatic-module-name	micrometer.commons	Medium
Product	Manifest	branch	HEAD	Low
Product	Manifest	build-date	2026-06-08_05:57:33	Low
Product	Manifest	build-date-utc	2026-06-08T05:57:33.437169978Z	Low
Product	Manifest	build-host	320eea4f7654	Low
Product	Manifest	build-job	deploy	Low
Product	Manifest	build-number	70801	Low
Product	Manifest	build-timezone	Etc/UTC	Low
Product	Manifest	build-url	https://circleci.com/gh/micrometer-metrics/micrometer/70801	Low
Product	Manifest	built-os	Linux	Low
Product	Manifest	built-status	release	Low
Product	Manifest	Bundle-Name	micrometer-commons	Medium
Product	Manifest	bundle-symbolicname	micrometer-commons	Medium
Product	Manifest	change	dc2e5e2	Low
Product	Manifest	full-change	dc2e5e2ea33a41a271b4b40e796ef39f1ed056af	Low
Product	Manifest	Implementation-Title	io.micrometer#micrometer-commons;1.15.12	High
Product	Manifest	module-email	tludwig@vmware.com	Low
Product	Manifest	module-origin	micrometer-metrics/micrometer.git	Low
Product	Manifest	module-owner	tludwig@vmware.com	Low
Product	Manifest	module-source	/micrometer-commons	Low
Product	pom	artifactid	micrometer-commons	Highest
Product	pom	developer email	tludwig@vmware.com	Low
Product	pom	developer id	shakuzen	Low
Product	pom	developer name	Tommy Ludwig	Low
Product	pom	groupid	io.micrometer	Highest
Product	pom	name	micrometer-commons	High
Product	pom	url	micrometer-metrics/micrometer	High
Version	file	version	1.15.12	High
Version	Manifest	Bundle-Version	1.15.12	High
Version	Manifest	Implementation-Version	1.15.12	High
Version	pom	version	1.15.12	Highest

Identifiers

pkg:maven/io.micrometer/micrometer-commons@1.15.12 (Confidence:High)

Description:

Module containing common code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/io/micrometer/micrometer-commons/1.16.7/micrometer-commons-1.16.7.jar
MD5: 952b8470311050de186bed6c354dadea
SHA1: ed85a2983e52358be84a6c8c3522b968ff41e500
SHA256:cd1ad64a94650a2ed3988a4ab48c9a7fad40c4986a81e328194dd757b5170273
Referenced In Project/Scope: waffle-spring-security7:compile
pkg:maven/org.springframework/spring-context@7.0.9

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	micrometer-commons	High
Vendor	jar	package name	common	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	micrometer	Highest
Vendor	Manifest	automatic-module-name	micrometer.commons	Medium
Vendor	Manifest	branch	release/1.16.7	Low
Vendor	Manifest	build-date	2026-08-17_07:25:36	Low
Vendor	Manifest	build-date-utc	2026-08-17T07:25:36.552419142Z	Low
Vendor	Manifest	build-host	https://github.com	Low
Vendor	Manifest	build-job	build-release	Low
Vendor	Manifest	build-number	49	Low
Vendor	Manifest	build-timezone	Etc/UTC	Low
Vendor	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005689840	Low
Vendor	Manifest	built-os	Linux	Low
Vendor	Manifest	built-status	integration	Low
Vendor	Manifest	bundle-symbolicname	micrometer-commons	Medium
Vendor	Manifest	change	2109514	Low
Vendor	Manifest	full-change	21095149cbb82b914bd9c0688a1622a4a3220f85	Low
Vendor	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Vendor	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	pom	artifactid	micrometer-commons	Highest
Vendor	pom	artifactid	micrometer-commons	Low
Vendor	pom	developer email	jivanov@vmware.com	Low
Vendor	pom	developer email	tludwig@vmware.com	Low
Vendor	pom	developer id	jonatan-ivanov	Medium
Vendor	pom	developer id	shakuzen	Medium
Vendor	pom	developer name	Jonatan Ivanov	Medium
Vendor	pom	developer name	Tommy Ludwig	Medium
Vendor	pom	groupid	io.micrometer	Highest
Vendor	pom	name	micrometer-commons	High
Vendor	pom	url	micrometer-metrics/micrometer-commercial	Highest
Product	file	name	micrometer-commons	High
Product	jar	package name	common	Highest
Product	jar	package name	io	Highest
Product	jar	package name	micrometer	Highest
Product	Manifest	automatic-module-name	micrometer.commons	Medium
Product	Manifest	branch	release/1.16.7	Low
Product	Manifest	build-date	2026-08-17_07:25:36	Low
Product	Manifest	build-date-utc	2026-08-17T07:25:36.552419142Z	Low
Product	Manifest	build-host	https://github.com	Low
Product	Manifest	build-job	build-release	Low
Product	Manifest	build-number	49	Low
Product	Manifest	build-timezone	Etc/UTC	Low
Product	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005689840	Low
Product	Manifest	built-os	Linux	Low
Product	Manifest	built-status	integration	Low
Product	Manifest	Bundle-Name	micrometer-commons	Medium
Product	Manifest	bundle-symbolicname	micrometer-commons	Medium
Product	Manifest	change	2109514	Low
Product	Manifest	full-change	21095149cbb82b914bd9c0688a1622a4a3220f85	Low
Product	Manifest	Implementation-Title	io.micrometer#micrometer-commons;1.16.7	High
Product	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Product	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Product	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Product	pom	artifactid	micrometer-commons	Highest
Product	pom	developer email	jivanov@vmware.com	Low
Product	pom	developer email	tludwig@vmware.com	Low
Product	pom	developer id	jonatan-ivanov	Low
Product	pom	developer id	shakuzen	Low
Product	pom	developer name	Jonatan Ivanov	Low
Product	pom	developer name	Tommy Ludwig	Low
Product	pom	groupid	io.micrometer	Highest
Product	pom	name	micrometer-commons	High
Product	pom	url	micrometer-metrics/micrometer-commercial	High
Version	file	version	1.16.7	High
Version	Manifest	Bundle-Version	1.16.7	High
Version	Manifest	Implementation-Version	1.16.7	High
Version	pom	version	1.16.7	Highest

Identifiers

pkg:maven/io.micrometer/micrometer-commons@1.16.7 (Confidence:High)

Description:

Module containing common code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/io/micrometer/micrometer-commons/1.17.1/micrometer-commons-1.17.1.jar
MD5: aa9291ad211473834d3d48453ae05ea1
SHA1: b1c3fdea68c5a81495cf1c16cf2905c5ad9f30d2
SHA256:f2cee6ef046e72eec8128474c7f58c6217173b45ae373c30de0289f2a56ab0fd
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	micrometer-commons	High
Vendor	jar	package name	common	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	micrometer	Highest
Vendor	Manifest	automatic-module-name	micrometer.commons	Medium
Vendor	Manifest	branch	release/1.17.1	Low
Vendor	Manifest	build-date	2026-08-17_07:25:39	Low
Vendor	Manifest	build-date-utc	2026-08-17T07:25:39.516694470Z	Low
Vendor	Manifest	build-host	https://github.com	Low
Vendor	Manifest	build-job	build-release	Low
Vendor	Manifest	build-number	50	Low
Vendor	Manifest	build-timezone	Etc/UTC	Low
Vendor	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005692132	Low
Vendor	Manifest	built-os	Linux	Low
Vendor	Manifest	built-status	integration	Low
Vendor	Manifest	bundle-symbolicname	micrometer-commons	Medium
Vendor	Manifest	change	f1b1924	Low
Vendor	Manifest	full-change	f1b1924bc8821adbc841df69eb433c933e17e1a5	Low
Vendor	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Vendor	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	pom	artifactid	micrometer-commons	Highest
Vendor	pom	artifactid	micrometer-commons	Low
Vendor	pom	developer email	jivanov@vmware.com	Low
Vendor	pom	developer email	tludwig@vmware.com	Low
Vendor	pom	developer id	jonatan-ivanov	Medium
Vendor	pom	developer id	shakuzen	Medium
Vendor	pom	developer name	Jonatan Ivanov	Medium
Vendor	pom	developer name	Tommy Ludwig	Medium
Vendor	pom	groupid	io.micrometer	Highest
Vendor	pom	name	micrometer-commons	High
Vendor	pom	url	micrometer-metrics/micrometer-commercial	Highest
Product	file	name	micrometer-commons	High
Product	jar	package name	common	Highest
Product	jar	package name	io	Highest
Product	jar	package name	micrometer	Highest
Product	Manifest	automatic-module-name	micrometer.commons	Medium
Product	Manifest	branch	release/1.17.1	Low
Product	Manifest	build-date	2026-08-17_07:25:39	Low
Product	Manifest	build-date-utc	2026-08-17T07:25:39.516694470Z	Low
Product	Manifest	build-host	https://github.com	Low
Product	Manifest	build-job	build-release	Low
Product	Manifest	build-number	50	Low
Product	Manifest	build-timezone	Etc/UTC	Low
Product	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005692132	Low
Product	Manifest	built-os	Linux	Low
Product	Manifest	built-status	integration	Low
Product	Manifest	Bundle-Name	micrometer-commons	Medium
Product	Manifest	bundle-symbolicname	micrometer-commons	Medium
Product	Manifest	change	f1b1924	Low
Product	Manifest	full-change	f1b1924bc8821adbc841df69eb433c933e17e1a5	Low
Product	Manifest	Implementation-Title	io.micrometer#micrometer-commons;1.17.1	High
Product	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Product	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Product	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Product	pom	artifactid	micrometer-commons	Highest
Product	pom	developer email	jivanov@vmware.com	Low
Product	pom	developer email	tludwig@vmware.com	Low
Product	pom	developer id	jonatan-ivanov	Low
Product	pom	developer id	shakuzen	Low
Product	pom	developer name	Jonatan Ivanov	Low
Product	pom	developer name	Tommy Ludwig	Low
Product	pom	groupid	io.micrometer	Highest
Product	pom	name	micrometer-commons	High
Product	pom	url	micrometer-metrics/micrometer-commercial	High
Version	file	version	1.17.1	High
Version	Manifest	Bundle-Version	1.17.1	High
Version	Manifest	Implementation-Version	1.17.1	High
Version	pom	version	1.17.1	Highest

Identifiers

pkg:maven/io.micrometer/micrometer-commons@1.17.1 (Confidence:High)

Description:

Module containing Observation related code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/io/micrometer/micrometer-observation/1.15.12/micrometer-observation-1.15.12.jar
MD5: b6ea6ebf93debb874d7c10f3ae79a471
SHA1: 1d96fcaec8d2516236dfcb9914108e14bfd02238
SHA256:54483e68ed44af1bb0c36d1df2235d36f233e459d52f5a3be3e69813827a6300
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-form-jakarta:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile
waffle-spring-security6:compile

pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework/spring-context@6.2.19

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	micrometer-observation	High
Vendor	jar	package name	io	Highest
Vendor	jar	package name	micrometer	Highest
Vendor	jar	package name	observation	Highest
Vendor	Manifest	automatic-module-name	micrometer.observation	Medium
Vendor	Manifest	branch	HEAD	Low
Vendor	Manifest	build-date	2026-06-08_05:57:34	Low
Vendor	Manifest	build-date-utc	2026-06-08T05:57:34.134088941Z	Low
Vendor	Manifest	build-host	320eea4f7654	Low
Vendor	Manifest	build-job	deploy	Low
Vendor	Manifest	build-number	70801	Low
Vendor	Manifest	build-timezone	Etc/UTC	Low
Vendor	Manifest	build-url	https://circleci.com/gh/micrometer-metrics/micrometer/70801	Low
Vendor	Manifest	built-os	Linux	Low
Vendor	Manifest	built-status	release	Low
Vendor	Manifest	bundle-symbolicname	micrometer-observation	Medium
Vendor	Manifest	change	dc2e5e2	Low
Vendor	Manifest	full-change	dc2e5e2ea33a41a271b4b40e796ef39f1ed056af	Low
Vendor	Manifest	module-email	tludwig@vmware.com	Low
Vendor	Manifest	module-origin	micrometer-metrics/micrometer.git	Low
Vendor	Manifest	module-owner	tludwig@vmware.com	Low
Vendor	Manifest	module-source	/micrometer-observation	Low
Vendor	pom	artifactid	micrometer-observation	Highest
Vendor	pom	artifactid	micrometer-observation	Low
Vendor	pom	developer email	tludwig@vmware.com	Low
Vendor	pom	developer id	shakuzen	Medium
Vendor	pom	developer name	Tommy Ludwig	Medium
Vendor	pom	groupid	io.micrometer	Highest
Vendor	pom	name	micrometer-observation	High
Vendor	pom	url	micrometer-metrics/micrometer	Highest
Product	file	name	micrometer-observation	High
Product	jar	package name	io	Highest
Product	jar	package name	micrometer	Highest
Product	jar	package name	observation	Highest
Product	Manifest	automatic-module-name	micrometer.observation	Medium
Product	Manifest	branch	HEAD	Low
Product	Manifest	build-date	2026-06-08_05:57:34	Low
Product	Manifest	build-date-utc	2026-06-08T05:57:34.134088941Z	Low
Product	Manifest	build-host	320eea4f7654	Low
Product	Manifest	build-job	deploy	Low
Product	Manifest	build-number	70801	Low
Product	Manifest	build-timezone	Etc/UTC	Low
Product	Manifest	build-url	https://circleci.com/gh/micrometer-metrics/micrometer/70801	Low
Product	Manifest	built-os	Linux	Low
Product	Manifest	built-status	release	Low
Product	Manifest	Bundle-Name	micrometer-observation	Medium
Product	Manifest	bundle-symbolicname	micrometer-observation	Medium
Product	Manifest	change	dc2e5e2	Low
Product	Manifest	full-change	dc2e5e2ea33a41a271b4b40e796ef39f1ed056af	Low
Product	Manifest	Implementation-Title	io.micrometer#micrometer-observation;1.15.12	High
Product	Manifest	module-email	tludwig@vmware.com	Low
Product	Manifest	module-origin	micrometer-metrics/micrometer.git	Low
Product	Manifest	module-owner	tludwig@vmware.com	Low
Product	Manifest	module-source	/micrometer-observation	Low
Product	pom	artifactid	micrometer-observation	Highest
Product	pom	developer email	tludwig@vmware.com	Low
Product	pom	developer id	shakuzen	Low
Product	pom	developer name	Tommy Ludwig	Low
Product	pom	groupid	io.micrometer	Highest
Product	pom	name	micrometer-observation	High
Product	pom	url	micrometer-metrics/micrometer	High
Version	file	version	1.15.12	High
Version	Manifest	Bundle-Version	1.15.12	High
Version	Manifest	Implementation-Version	1.15.12	High
Version	pom	version	1.15.12	Highest

Identifiers

pkg:maven/io.micrometer/micrometer-observation@1.15.12 (Confidence:High)

Description:

Module containing Observation related code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/io/micrometer/micrometer-observation/1.16.7/micrometer-observation-1.16.7.jar
MD5: ff4722ca94dde41f70801dbdf5f77c9b
SHA1: 5387e97e74b61892affb7c4b4cafa9df6d6ca6d2
SHA256:74f9e4d51ef30c141de8a2409879282e572eef98665e033e8922c2fbee16862d
Referenced In Project/Scope: waffle-spring-security7:compile
pkg:maven/org.springframework/spring-context@7.0.9

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	micrometer-observation	High
Vendor	jar	package name	io	Highest
Vendor	jar	package name	micrometer	Highest
Vendor	jar	package name	observation	Highest
Vendor	Manifest	automatic-module-name	micrometer.observation	Medium
Vendor	Manifest	branch	release/1.16.7	Low
Vendor	Manifest	build-date	2026-08-17_07:25:36	Low
Vendor	Manifest	build-date-utc	2026-08-17T07:25:36.994453332Z	Low
Vendor	Manifest	build-host	https://github.com	Low
Vendor	Manifest	build-job	build-release	Low
Vendor	Manifest	build-number	49	Low
Vendor	Manifest	build-timezone	Etc/UTC	Low
Vendor	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005689840	Low
Vendor	Manifest	built-os	Linux	Low
Vendor	Manifest	built-status	integration	Low
Vendor	Manifest	bundle-symbolicname	micrometer-observation	Medium
Vendor	Manifest	change	2109514	Low
Vendor	Manifest	full-change	21095149cbb82b914bd9c0688a1622a4a3220f85	Low
Vendor	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Vendor	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	pom	artifactid	micrometer-observation	Highest
Vendor	pom	artifactid	micrometer-observation	Low
Vendor	pom	developer email	jivanov@vmware.com	Low
Vendor	pom	developer email	tludwig@vmware.com	Low
Vendor	pom	developer id	jonatan-ivanov	Medium
Vendor	pom	developer id	shakuzen	Medium
Vendor	pom	developer name	Jonatan Ivanov	Medium
Vendor	pom	developer name	Tommy Ludwig	Medium
Vendor	pom	groupid	io.micrometer	Highest
Vendor	pom	name	micrometer-observation	High
Vendor	pom	url	micrometer-metrics/micrometer-commercial	Highest
Product	file	name	micrometer-observation	High
Product	jar	package name	io	Highest
Product	jar	package name	micrometer	Highest
Product	jar	package name	observation	Highest
Product	Manifest	automatic-module-name	micrometer.observation	Medium
Product	Manifest	branch	release/1.16.7	Low
Product	Manifest	build-date	2026-08-17_07:25:36	Low
Product	Manifest	build-date-utc	2026-08-17T07:25:36.994453332Z	Low
Product	Manifest	build-host	https://github.com	Low
Product	Manifest	build-job	build-release	Low
Product	Manifest	build-number	49	Low
Product	Manifest	build-timezone	Etc/UTC	Low
Product	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005689840	Low
Product	Manifest	built-os	Linux	Low
Product	Manifest	built-status	integration	Low
Product	Manifest	Bundle-Name	micrometer-observation	Medium
Product	Manifest	bundle-symbolicname	micrometer-observation	Medium
Product	Manifest	change	2109514	Low
Product	Manifest	full-change	21095149cbb82b914bd9c0688a1622a4a3220f85	Low
Product	Manifest	Implementation-Title	io.micrometer#micrometer-observation;1.16.7	High
Product	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Product	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Product	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Product	pom	artifactid	micrometer-observation	Highest
Product	pom	developer email	jivanov@vmware.com	Low
Product	pom	developer email	tludwig@vmware.com	Low
Product	pom	developer id	jonatan-ivanov	Low
Product	pom	developer id	shakuzen	Low
Product	pom	developer name	Jonatan Ivanov	Low
Product	pom	developer name	Tommy Ludwig	Low
Product	pom	groupid	io.micrometer	Highest
Product	pom	name	micrometer-observation	High
Product	pom	url	micrometer-metrics/micrometer-commercial	High
Version	file	version	1.16.7	High
Version	Manifest	Bundle-Version	1.16.7	High
Version	Manifest	Implementation-Version	1.16.7	High
Version	pom	version	1.16.7	Highest

Identifiers

pkg:maven/io.micrometer/micrometer-observation@1.16.7 (Confidence:High)

Description:

Module containing Observation related code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/io/micrometer/micrometer-observation/1.17.1/micrometer-observation-1.17.1.jar
MD5: f63baf5840fb4446b9313a3bd8773da1
SHA1: 24c0b05bc06a9ab6f4e09a48949b6eccc179ca15
SHA256:eb34f0cd84a879393ae5c21160fc06385ccdc74f36a4d1e31b199f59acfdaf71
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	micrometer-observation	High
Vendor	jar	package name	io	Highest
Vendor	jar	package name	micrometer	Highest
Vendor	jar	package name	observation	Highest
Vendor	Manifest	automatic-module-name	micrometer.observation	Medium
Vendor	Manifest	branch	release/1.17.1	Low
Vendor	Manifest	build-date	2026-08-17_07:25:39	Low
Vendor	Manifest	build-date-utc	2026-08-17T07:25:39.958346319Z	Low
Vendor	Manifest	build-host	https://github.com	Low
Vendor	Manifest	build-job	build-release	Low
Vendor	Manifest	build-number	50	Low
Vendor	Manifest	build-timezone	Etc/UTC	Low
Vendor	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005692132	Low
Vendor	Manifest	built-os	Linux	Low
Vendor	Manifest	built-status	integration	Low
Vendor	Manifest	bundle-symbolicname	micrometer-observation	Medium
Vendor	Manifest	change	f1b1924	Low
Vendor	Manifest	full-change	f1b1924bc8821adbc841df69eb433c933e17e1a5	Low
Vendor	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Vendor	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Vendor	pom	artifactid	micrometer-observation	Highest
Vendor	pom	artifactid	micrometer-observation	Low
Vendor	pom	developer email	jivanov@vmware.com	Low
Vendor	pom	developer email	tludwig@vmware.com	Low
Vendor	pom	developer id	jonatan-ivanov	Medium
Vendor	pom	developer id	shakuzen	Medium
Vendor	pom	developer name	Jonatan Ivanov	Medium
Vendor	pom	developer name	Tommy Ludwig	Medium
Vendor	pom	groupid	io.micrometer	Highest
Vendor	pom	name	micrometer-observation	High
Vendor	pom	url	micrometer-metrics/micrometer-commercial	Highest
Product	file	name	micrometer-observation	High
Product	jar	package name	io	Highest
Product	jar	package name	micrometer	Highest
Product	jar	package name	observation	Highest
Product	Manifest	automatic-module-name	micrometer.observation	Medium
Product	Manifest	branch	release/1.17.1	Low
Product	Manifest	build-date	2026-08-17_07:25:39	Low
Product	Manifest	build-date-utc	2026-08-17T07:25:39.958346319Z	Low
Product	Manifest	build-host	https://github.com	Low
Product	Manifest	build-job	build-release	Low
Product	Manifest	build-number	50	Low
Product	Manifest	build-timezone	Etc/UTC	Low
Product	Manifest	build-url	https://github.com/micrometer-metrics/micrometer-commercial/actions/runs/32005692132	Low
Product	Manifest	built-os	Linux	Low
Product	Manifest	built-status	integration	Low
Product	Manifest	Bundle-Name	micrometer-observation	Medium
Product	Manifest	bundle-symbolicname	micrometer-observation	Medium
Product	Manifest	change	f1b1924	Low
Product	Manifest	full-change	f1b1924bc8821adbc841df69eb433c933e17e1a5	Low
Product	Manifest	Implementation-Title	io.micrometer#micrometer-observation;1.17.1	High
Product	Manifest	module-email	tludwig@vmware.com,jivanov@vmware.com	Low
Product	Manifest	module-origin	https://github.com/micrometer-metrics/micrometer-commercial.git	Low
Product	Manifest	module-owner	tludwig@vmware.com,jivanov@vmware.com	Low
Product	pom	artifactid	micrometer-observation	Highest
Product	pom	developer email	jivanov@vmware.com	Low
Product	pom	developer email	tludwig@vmware.com	Low
Product	pom	developer id	jonatan-ivanov	Low
Product	pom	developer id	shakuzen	Low
Product	pom	developer name	Jonatan Ivanov	Low
Product	pom	developer name	Tommy Ludwig	Low
Product	pom	groupid	io.micrometer	Highest
Product	pom	name	micrometer-observation	High
Product	pom	url	micrometer-metrics/micrometer-commercial	High
Version	file	version	1.17.1	High
Version	Manifest	Bundle-Version	1.17.1	High
Version	Manifest	Implementation-Version	1.17.1	High
Version	pom	version	1.17.1	Highest

Identifiers

pkg:maven/io.micrometer/micrometer-observation@1.17.1 (Confidence:High)

Description:

Mockito mock objects library core API and implementation

License:

MIT: https://opensource.org/licenses/MIT

File Path: /home/runner/.m2/repository/org/mockito/mockito-core/5.23.0/mockito-core-5.23.0.jar
MD5: 43deb29e8c5ab688ee5547be72e10ea3
SHA1: a5cf3cf244300e4cd05f779827cf50d373a8460e
SHA256:ae295bebd5d11fab97ab297815dc7617188b86003cbce3dfd5c0d5c3a6cc4a0c
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

pkg:maven/com.github.waffle/waffle-tests-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mockito-core	High
Vendor	jar	package name	and	Highest
Vendor	jar	package name	api	Highest
Vendor	jar	package name	mockito	Highest
Vendor	Manifest	bundle-symbolicname	org.mockito.mockito-core	Medium
Vendor	Manifest	can-retransform-classes	true	Low
Vendor	pom	artifactid	mockito-core	Highest
Vendor	pom	artifactid	mockito-core	Low
Vendor	pom	developer id	bric3	Medium
Vendor	pom	developer id	mockitoguy	Medium
Vendor	pom	developer id	raphw	Medium
Vendor	pom	developer id	TimvdLippe	Medium
Vendor	pom	developer name	Brice Dutheil	Medium
Vendor	pom	developer name	Rafael Winterhalter	Medium
Vendor	pom	developer name	Szczepan Faber	Medium
Vendor	pom	developer name	Tim van der Lippe	Medium
Vendor	pom	groupid	org.mockito	Highest
Vendor	pom	name	mockito-core	High
Vendor	pom	url	mockito/mockito	Highest
Product	file	name	mockito-core	High
Product	jar	package name	and	Highest
Product	jar	package name	api	Highest
Product	jar	package name	mockito	Highest
Product	Manifest	Bundle-Name	Mockito Mock Library for Java. Core bundle requires Byte Buddy and Objenesis.	Medium
Product	Manifest	bundle-symbolicname	org.mockito.mockito-core	Medium
Product	Manifest	can-retransform-classes	true	Low
Product	pom	artifactid	mockito-core	Highest
Product	pom	developer id	bric3	Low
Product	pom	developer id	mockitoguy	Low
Product	pom	developer id	raphw	Low
Product	pom	developer id	TimvdLippe	Low
Product	pom	developer name	Brice Dutheil	Low
Product	pom	developer name	Rafael Winterhalter	Low
Product	pom	developer name	Szczepan Faber	Low
Product	pom	developer name	Tim van der Lippe	Low
Product	pom	groupid	org.mockito	Highest
Product	pom	name	mockito-core	High
Product	pom	url	mockito/mockito	High
Version	file	version	5.23.0	High
Version	Manifest	Bundle-Version	5.23.0	High
Version	pom	version	5.23.0	Highest

Identifiers

pkg:maven/org.mockito/mockito-core@5.23.0 (Confidence:High)

Description:

A rebundling of Apache Tomcat Jasper to remove the tomcat server dependencies,    so that the JSP engine can be used by the Eclipse Jetty project.

License:

http://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/mortbay/jasper/mortbay-apache-el/10.1.56/mortbay-apache-el-10.1.56.jar
MD5: f2e4c0483fc1052343a36590931823cb
SHA1: ee230761258bb168724ed58db9a53502013036a6
SHA256:92bdc12a242363af73340c3bc88d0b9d00d84013345c30556a40676a4036b033
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-apache-jsp@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mortbay-apache-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	el	Highest
Vendor	Manifest	automatic-module-name	org.mortbay.apache.el	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Vendor	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-el	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse.org - Jetty	High
Vendor	Manifest	provide-capability	osgi.serviceloader;osgi.serviceloader="jakarta.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	url	http://www.eclipse.org/jetty	Low
Vendor	pom	artifactid	mortbay-apache-el	Highest
Vendor	pom	artifactid	mortbay-apache-el	Low
Vendor	pom	groupid	org.mortbay.jasper	Highest
Vendor	pom	name	MortBay :: Apache EL :: Implementation	High
Vendor	pom	parent-artifactid	jasper-jsp	Low
Product	file	name	mortbay-apache-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	expressionfactoryimpl	Highest
Product	Manifest	automatic-module-name	org.mortbay.apache.el	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Product	Manifest	Bundle-Name	Mortbay Apache EL Implementation	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Product	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-el	Medium
Product	Manifest	provide-capability	osgi.serviceloader;osgi.serviceloader="jakarta.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	url	http://www.eclipse.org/jetty	Low
Product	pom	artifactid	mortbay-apache-el	Highest
Product	pom	groupid	org.mortbay.jasper	Highest
Product	pom	name	MortBay :: Apache EL :: Implementation	High
Product	pom	parent-artifactid	jasper-jsp	Medium
Version	file	version	10.1.56	High
Version	Manifest	Bundle-Version	10.1.56	High
Version	Manifest	Implementation-Version	10.1.56	High
Version	pom	version	10.1.56	Highest

Identifiers

pkg:maven/org.mortbay.jasper/mortbay-apache-el@10.1.56 (Confidence:High)

Description:

A rebundling of Apache Tomcat Jasper to remove the tomcat server dependencies,    so that the JSP engine can be used by the Eclipse Jetty project.

License:

http://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/mortbay/jasper/mortbay-apache-el/9.0.119/mortbay-apache-el-9.0.119.jar
MD5: 629f1ad5bd54586a93240bc36c358cf2
SHA1: fc4c24b7b8197f680736a5340ef75fe022e7487c
SHA256:ed82234bbd6c393900fabc0babe0ba94819286e8cdde6e0d185f7409a6ca6f9a
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mortbay-apache-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	el	Highest
Vendor	Manifest	automatic-module-name	org.mortbay.apache.el	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Vendor	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-el	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse.org - Jetty	High
Vendor	Manifest	url	http://www.eclipse.org/jetty	Low
Vendor	pom	artifactid	mortbay-apache-el	Highest
Vendor	pom	artifactid	mortbay-apache-el	Low
Vendor	pom	groupid	org.mortbay.jasper	Highest
Vendor	pom	name	MortBay :: Apache EL :: API and Implementation	High
Vendor	pom	parent-artifactid	jasper-jsp	Low
Product	file	name	mortbay-apache-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	Manifest	automatic-module-name	org.mortbay.apache.el	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Product	Manifest	Bundle-Name	Mortbay Apache EL API and Implementation	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Product	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-el	Medium
Product	Manifest	url	http://www.eclipse.org/jetty	Low
Product	pom	artifactid	mortbay-apache-el	Highest
Product	pom	groupid	org.mortbay.jasper	Highest
Product	pom	name	MortBay :: Apache EL :: API and Implementation	High
Product	pom	parent-artifactid	jasper-jsp	Medium
Version	file	version	9.0.119	High
Version	Manifest	Bundle-Version	9.0.119	High
Version	Manifest	Implementation-Version	9.0.119	High
Version	pom	version	9.0.119	Highest

Identifiers

pkg:maven/org.mortbay.jasper/mortbay-apache-el@9.0.119 (Confidence:High)

Description:

A rebundling of Apache Tomcat Jasper to remove the tomcat server dependencies,    so that the JSP engine can be used by the Eclipse Jetty project.

License:

http://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/mortbay/jasper/mortbay-apache-jsp/10.1.56/mortbay-apache-jsp-10.1.56.jar
MD5: 65905541a402393623ee1959513d6e48
SHA1: 47ba80fff500a4251fa51775f58f105780569503
SHA256:63deb3b3463c64b0c5122b3b754e43bc58c0fa0c212bda4a69dad4b39682a8fb
Referenced In Project/Scope: waffle-jetty-jakarta:provided
pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-apache-jsp@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mortbay-apache-jsp	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	jasper	Highest
Vendor	Manifest	automatic-module-name	org.mortbay.apache.jasper	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Vendor	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-jsp	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse.org - Jetty	High
Vendor	Manifest	url	http://www.eclipse.org/jetty	Low
Vendor	pom	artifactid	mortbay-apache-jsp	Highest
Vendor	pom	artifactid	mortbay-apache-jsp	Low
Vendor	pom	groupid	org.mortbay.jasper	Highest
Vendor	pom	name	MortBay :: Apache Jasper :: JSP Implementation	High
Vendor	pom	parent-artifactid	jasper-jsp	Low
Product	file	name	mortbay-apache-jsp	High
Product	jar	package name	apache	Highest
Product	jar	package name	jasper	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	automatic-module-name	org.mortbay.apache.jasper	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Product	Manifest	Bundle-Name	Mortbay Jasper	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Product	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-jsp	Medium
Product	Manifest	url	http://www.eclipse.org/jetty	Low
Product	pom	artifactid	mortbay-apache-jsp	Highest
Product	pom	groupid	org.mortbay.jasper	Highest
Product	pom	name	MortBay :: Apache Jasper :: JSP Implementation	High
Product	pom	parent-artifactid	jasper-jsp	Medium
Version	file	version	10.1.56	High
Version	Manifest	Bundle-Version	10.1.56	High
Version	Manifest	Implementation-Version	10.1.56	High
Version	pom	version	10.1.56	Highest

Identifiers

pkg:maven/org.mortbay.jasper/mortbay-apache-jsp@10.1.56 (Confidence:High)

Description:

A rebundling of Apache Tomcat Jasper to remove the tomcat server dependencies,    so that the JSP engine can be used by the Eclipse Jetty project.

License:

http://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/mortbay/jasper/mortbay-apache-jsp/9.0.119/mortbay-apache-jsp-9.0.119.jar
MD5: 5d2b6eb420f9401a2ae3f95717e2e7dd
SHA1: 3b833f390303e6e094765e06a5071ad5c276d1b7
SHA256:dda5cffb7de80a2f2709d42836b4a52353f21e00122688eec08bb4a2e291de26
Referenced In Project/Scope: waffle-jetty:provided
pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.13

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mortbay-apache-jsp	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	jasper	Highest
Vendor	jar	package name	jsp	Highest
Vendor	Manifest	automatic-module-name	org.mortbay.apache.jasper	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Vendor	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-jsp	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse.org - Jetty	High
Vendor	Manifest	url	http://www.eclipse.org/jetty	Low
Vendor	pom	artifactid	mortbay-apache-jsp	Highest
Vendor	pom	artifactid	mortbay-apache-jsp	Low
Vendor	pom	groupid	org.mortbay.jasper	Highest
Vendor	pom	name	MortBay :: Apache Jasper :: JSP Implementation	High
Vendor	pom	parent-artifactid	jasper-jsp	Low
Product	file	name	mortbay-apache-jsp	High
Product	jar	package name	apache	Highest
Product	jar	package name	jasper	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	automatic-module-name	org.mortbay.apache.jasper	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-docurl	https://eclipse.dev/jetty/	Low
Product	Manifest	Bundle-Name	Mortbay Jasper	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.7	Low
Product	Manifest	bundle-symbolicname	org.mortbay.jasper.mortbay-apache-jsp	Medium
Product	Manifest	url	http://www.eclipse.org/jetty	Low
Product	pom	artifactid	mortbay-apache-jsp	Highest
Product	pom	groupid	org.mortbay.jasper	Highest
Product	pom	name	MortBay :: Apache Jasper :: JSP Implementation	High
Product	pom	parent-artifactid	jasper-jsp	Medium
Version	file	version	9.0.119	High
Version	Manifest	Bundle-Version	9.0.119	High
Version	Manifest	Implementation-Version	9.0.119	High
Version	pom	version	9.0.119	Highest

Identifiers

pkg:maven/org.mortbay.jasper/mortbay-apache-jsp@9.0.119 (Confidence:High)

Description:

A library for instantiating Java objects

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/objenesis/objenesis/3.6/objenesis-3.6.jar
MD5: 187d2c7d3ba62a360d17a046cad50e7e
SHA1: 658298a7faa84bab1933dcb46107c603c4a16f92
SHA256:6ecc0fc776af04e2bfd2bf42d618ab5161440dcb8a0e7dff9e84c065c7cec3dd
Referenced In Projects/Scopes:

waffle-tests-jakarta:compile
waffle-tests:compile

pkg:maven/org.mockito/mockito-core@5.23.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	objenesis	High
Vendor	jar	package name	objenesis	Highest
Vendor	Manifest	automatic-module-name	org.objenesis	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-symbolicname	org.objenesis	Medium
Vendor	Manifest	Implementation-Vendor	Joe Walnes, Henri Tremblay, Leonardo Mesquita	High
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Vendor	Manifest	specification-vendor	Joe Walnes, Henri Tremblay, Leonardo Mesquita	Low
Vendor	pom	artifactid	objenesis	Highest
Vendor	pom	artifactid	objenesis	Low
Vendor	pom	groupid	org.objenesis	Highest
Vendor	pom	name	Objenesis	High
Vendor	pom	parent-artifactid	objenesis-parent	Low
Product	file	name	objenesis	High
Product	jar	package name	objenesis	Highest
Product	Manifest	automatic-module-name	org.objenesis	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	Bundle-Name	Objenesis	Medium
Product	Manifest	bundle-symbolicname	org.objenesis	Medium
Product	Manifest	Implementation-Title	Objenesis	High
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Product	Manifest	specification-title	Objenesis	Medium
Product	pom	artifactid	objenesis	Highest
Product	pom	groupid	org.objenesis	Highest
Product	pom	name	Objenesis	High
Product	pom	parent-artifactid	objenesis-parent	Medium
Version	file	version	3.6	High
Version	Manifest	Implementation-Version	3.6	High
Version	pom	version	3.6	Highest

Identifiers

pkg:maven/org.objenesis/objenesis@3.6 (Confidence:High)

Description:

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles        authentication, authorization, enterprise session management, single sign-on and cryptography services.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-core/2.2.1/shiro-core-2.2.1.jar
MD5: 3b83eaa1cf9fff4febadafc3a8dd1ea9
SHA1: 23d29cf0f69bd91049780b4d3b77e028a505abd3
SHA256:688489d58e00d40476e67be2cae8f349a6d51a21c0d16e4d856bcc6f6c9c2001
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/org.apache.shiro/shiro-web@2.2.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	shiro-core	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	shiro	Highest
Vendor	Manifest	automatic-module-name	org.apache.shiro.core	Medium
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://www.apache.org/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.shiro.core	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	shiro-core	Highest
Vendor	pom	artifactid	shiro-core	Low
Vendor	pom	groupid	org.apache.shiro	Highest
Vendor	pom	name	Apache Shiro :: Core	High
Vendor	pom	parent-artifactid	shiro-root	Low
Product	file	name	shiro-core	High
Product	jar	package name	apache	Highest
Product	jar	package name	session	Highest
Product	jar	package name	shiro	Highest
Product	Manifest	automatic-module-name	org.apache.shiro.core	Medium
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://www.apache.org/	Low
Product	Manifest	Bundle-Name	Apache Shiro :: Core	Medium
Product	Manifest	bundle-symbolicname	org.apache.shiro.core	Medium
Product	Manifest	Implementation-Title	Apache Shiro :: Core	High
Product	Manifest	specification-title	Apache Shiro :: Core	Medium
Product	pom	artifactid	shiro-core	Highest
Product	pom	groupid	org.apache.shiro	Highest
Product	pom	name	Apache Shiro :: Core	High
Product	pom	parent-artifactid	shiro-root	Medium
Version	file	version	2.2.1	High
Version	Manifest	Bundle-Version	2.2.1	High
Version	Manifest	Implementation-Version	2.2.1	High
Version	pom	version	2.2.1	Highest

Related Dependencies

shiro-cache-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-cache/2.2.1/shiro-cache-2.2.1.jar
- MD5: ac83e76d184dfb62204010de1c10b6cb
- SHA1: 2ad75e4aea6921cadfb35ecc734a58ddf712ea42
- SHA256: cf5bb8a3349165b34773abb17cc0e2e926cc292ce0a2f9b26af095ee2d376c8e
- pkg:maven/org.apache.shiro/shiro-cache@2.2.1
shiro-config-core-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-config-core/2.2.1/shiro-config-core-2.2.1.jar
- MD5: 21a7545ab9f9cf1b7b0c843ff0a84979
- SHA1: b25e12bdc24183e3a9a896009e97305b43ad0701
- SHA256: 7f64fe07e75d3afb48222d1020c6ab0e91445aa918fa852dd744802e3da2c72d
- pkg:maven/org.apache.shiro/shiro-config-core@2.2.1
shiro-config-ogdl-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-config-ogdl/2.2.1/shiro-config-ogdl-2.2.1.jar
- MD5: d0ba74ab0251da2c538cf704d1b00658
- SHA1: 5c10320334302891036e816daf951e040c63426f
- SHA256: 411b983dee3c7b7256c5140a1a4cd86b1004966e62029ec6e4a7795418bdb31a
- pkg:maven/org.apache.shiro/shiro-config-ogdl@2.2.1
shiro-crypto-cipher-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-cipher/2.2.1/shiro-crypto-cipher-2.2.1.jar
- MD5: 2b9854b97d52a833217160d34aeb84f2
- SHA1: 8dfe26beeb309d89d2dfbf2b8cce2d63d6882f32
- SHA256: f2c083d03eef731772b97728718d5ffeb71107ac0850c79b78283f8b1f29a193
- pkg:maven/org.apache.shiro/shiro-crypto-cipher@2.2.1
shiro-crypto-core-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-core/2.2.1/shiro-crypto-core-2.2.1.jar
- MD5: ccd62661f070a04684877e895e1f09f0
- SHA1: 8a1f005293319a68010203482a5d4d838f71f821
- SHA256: e8ac7be2365397dbc5f2b9dfad2a98941670202c612fd7e535afcefa7a503feb
- pkg:maven/org.apache.shiro/shiro-crypto-core@2.2.1
shiro-crypto-hash-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-hash/2.2.1/shiro-crypto-hash-2.2.1.jar
- MD5: bca90022c90dc05914e8401c4b0b1f4b
- SHA1: 525e45a85f809d021674558fcbe84c16c6df9390
- SHA256: 2ae3b681f6618ba56ff928255091d3ba72a364acdf0deebd55d4c4e093c3d7e8
- pkg:maven/org.apache.shiro/shiro-crypto-hash@2.2.1
shiro-event-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-event/2.2.1/shiro-event-2.2.1.jar
- MD5: df65381eb06c8d41057ab29bd0ebbc8f
- SHA1: 64a739820ef775d4b5d05ae8ef639c05d7d72058
- SHA256: 739446ee8581e13e670b8a27310e35902b8b8258e363e7bdd5f37758abbd86d7
- pkg:maven/org.apache.shiro/shiro-event@2.2.1
shiro-hashes-argon2-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/crypto/shiro-hashes-argon2/2.2.1/shiro-hashes-argon2-2.2.1.jar
- MD5: 2154316b03025bfbaa9ed98b66428c7a
- SHA1: ecb3e06966527c96e71466a5750fbe968b66853e
- SHA256: 2556fbf8ae5477679730a5cc1ba4aff223cc59d15879d64d43efd7cfdeb356cf
- pkg:maven/org.apache.shiro.crypto/shiro-hashes-argon2@2.2.1
shiro-hashes-bcrypt-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/crypto/shiro-hashes-bcrypt/2.2.1/shiro-hashes-bcrypt-2.2.1.jar
- MD5: 713956c7dd61cea72b74e0f5ec7a701a
- SHA1: 6eab5fb8d63fb2aeeac0a70285ea94ec26ecc6a1
- SHA256: a876b5934b74eac2ed0d4ca30fe8ed79052c1357c68ea36974dce32be15e77ec
- pkg:maven/org.apache.shiro.crypto/shiro-hashes-bcrypt@2.2.1
shiro-lang-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-lang/2.2.1/shiro-lang-2.2.1.jar
- MD5: 96a1747b0a95d8b7a08e339b3b87082b
- SHA1: da71729d2a052bd9dbecbc4df3e5931a839b98cd
- SHA256: a803f62e597b05d9550f0fd11943738442e4aa0d3f8432a430cd9bf3aef39ea9
- pkg:maven/org.apache.shiro/shiro-lang@2.2.1
shiro-web-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-web/2.2.1/shiro-web-2.2.1.jar
- MD5: 7ea1be5665e3cfa9fd5c42f936051322
- SHA1: 96cf3cd3cd9e5173e9a33eaf22a4bc4704019a51
- SHA256: 1129af8565d0bd9fe203a2894814ec937fa9230e0d04c6ab7b2f884b58fedcd7
- pkg:maven/org.apache.shiro/shiro-web@2.2.1

Identifiers

pkg:maven/org.apache.shiro/shiro-core@2.2.1 (Confidence:High)
cpe:2.3:a:apache:shiro:2.2.1:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.

Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. +
Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.

CWE-918 Server-Side Request Forgery (SSRF)

CVSSv4:

Base Score: MEDIUM (5.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:L/U:Amber

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* versions from (including) 2.0.0; versions up to (excluding) 3.0.1

Description:

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles
        authentication, authorization, enterprise session management, single sign-on and cryptography services.

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-core/3.0.1/shiro-core-3.0.1.jar
MD5: 9ac7d5980430e2012ae23af9c913c3b1
SHA1: d903077c9a5a9398fffef044cee2fb90719d99ff
SHA256:eed36f19b2978a4a219c84ba82c05a771a78de995943d4a517bb941ebfd81124
Referenced In Project/Scope: waffle-shiro-jakarta:provided
pkg:maven/org.apache.shiro/shiro-web@3.0.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	shiro-core	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	session	Highest
Vendor	jar	package name	shiro	Highest
Vendor	Manifest	automatic-module-name	org.apache.shiro.core	Medium
Vendor	Manifest	build-jdk-spec	25	Low
Vendor	Manifest	bundle-docurl	https://www.apache.org/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.shiro.core	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	shiro-core	Highest
Vendor	pom	artifactid	shiro-core	Low
Vendor	pom	developer email	aditzel@apache.org	Low
Vendor	pom	developer email	bdemers@apache.org	Low
Vendor	pom	developer email	bmarwell@apache.org	Low
Vendor	pom	developer email	fpapon@apache.org	Low
Vendor	pom	developer email	jbunting@apache.org	Low
Vendor	pom	developer email	jhaile@apache.org	Low
Vendor	pom	developer email	kaosko@apache.org	Low
Vendor	pom	developer email	lhazlewood@apache.org	Low
Vendor	pom	developer email	lprimak@apache.org	Low
Vendor	pom	developer email	p.ledbrook@cacoethes.co.uk	Low
Vendor	pom	developer email	tveil@apache.org	Low
Vendor	pom	developer id	aditzel	Medium
Vendor	pom	developer id	bdemers	Medium
Vendor	pom	developer id	bmarwell	Medium
Vendor	pom	developer id	fpapon	Medium
Vendor	pom	developer id	jbunting	Medium
Vendor	pom	developer id	jhaile	Medium
Vendor	pom	developer id	kaosko	Medium
Vendor	pom	developer id	lhazlewood	Medium
Vendor	pom	developer id	lprimak	Medium
Vendor	pom	developer id	pledbrook	Medium
Vendor	pom	developer id	tveil	Medium
Vendor	pom	developer name	Allan Ditzel	Medium
Vendor	pom	developer name	Benjamin Marwell	Medium
Vendor	pom	developer name	Brian Demers	Medium
Vendor	pom	developer name	Francois Papon	Medium
Vendor	pom	developer name	Jared Bunting	Medium
Vendor	pom	developer name	Jeremy Haile	Medium
Vendor	pom	developer name	Kalle Korhonen	Medium
Vendor	pom	developer name	Lenny Primak	Medium
Vendor	pom	developer name	Les Hazlewood	Medium
Vendor	pom	developer name	Peter Ledbrook	Medium
Vendor	pom	developer name	Tim Veil	Medium
Vendor	pom	developer org	Apache Software Foundation	Medium
Vendor	pom	developer org	Flow Logix	Medium
Vendor	pom	developer org	Mobilization Labs	Medium
Vendor	pom	developer org	SpringSource	Medium
Vendor	pom	developer org	Stormpath	Medium
Vendor	pom	developer org	Yupiik	Medium
Vendor	pom	developer org URL	http://www.mobilizationlabs.com	Medium
Vendor	pom	developer org URL	https://spring.io/	Medium
Vendor	pom	developer org URL	https://stormpath.com/	Medium
Vendor	pom	developer org URL	https://www.flowlogix.com/	Medium
Vendor	pom	developer org URL	https://www.stormpath.com	Medium
Vendor	pom	developer org URL	https://www.yupiik.com/	Medium
Vendor	pom	groupid	org.apache.shiro	Highest
Vendor	pom	name	Apache Shiro :: Core	High
Vendor	pom	organization name	The Apache Software Foundation	High
Vendor	pom	organization url	https://www.apache.org/	Medium
Vendor	pom	parent-artifactid	shiro-root	Low
Vendor	pom	url	https://shiro.apache.org/shiro-core/	Highest
Product	file	name	shiro-core	High
Product	jar	package name	25	Highest
Product	jar	package name	apache	Highest
Product	jar	package name	org	Highest
Product	jar	package name	session	Highest
Product	jar	package name	shiro	Highest
Product	Manifest	automatic-module-name	org.apache.shiro.core	Medium
Product	Manifest	build-jdk-spec	25	Low
Product	Manifest	bundle-docurl	https://www.apache.org/	Low
Product	Manifest	Bundle-Name	Apache Shiro :: Core	Medium
Product	Manifest	bundle-symbolicname	org.apache.shiro.core	Medium
Product	Manifest	Implementation-Title	Apache Shiro :: Core	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Shiro :: Core	Medium
Product	pom	artifactid	shiro-core	Highest
Product	pom	developer email	aditzel@apache.org	Low
Product	pom	developer email	bdemers@apache.org	Low
Product	pom	developer email	bmarwell@apache.org	Low
Product	pom	developer email	fpapon@apache.org	Low
Product	pom	developer email	jbunting@apache.org	Low
Product	pom	developer email	jhaile@apache.org	Low
Product	pom	developer email	kaosko@apache.org	Low
Product	pom	developer email	lhazlewood@apache.org	Low
Product	pom	developer email	lprimak@apache.org	Low
Product	pom	developer email	p.ledbrook@cacoethes.co.uk	Low
Product	pom	developer email	tveil@apache.org	Low
Product	pom	developer id	aditzel	Low
Product	pom	developer id	bdemers	Low
Product	pom	developer id	bmarwell	Low
Product	pom	developer id	fpapon	Low
Product	pom	developer id	jbunting	Low
Product	pom	developer id	jhaile	Low
Product	pom	developer id	kaosko	Low
Product	pom	developer id	lhazlewood	Low
Product	pom	developer id	lprimak	Low
Product	pom	developer id	pledbrook	Low
Product	pom	developer id	tveil	Low
Product	pom	developer name	Allan Ditzel	Low
Product	pom	developer name	Benjamin Marwell	Low
Product	pom	developer name	Brian Demers	Low
Product	pom	developer name	Francois Papon	Low
Product	pom	developer name	Jared Bunting	Low
Product	pom	developer name	Jeremy Haile	Low
Product	pom	developer name	Kalle Korhonen	Low
Product	pom	developer name	Lenny Primak	Low
Product	pom	developer name	Les Hazlewood	Low
Product	pom	developer name	Peter Ledbrook	Low
Product	pom	developer name	Tim Veil	Low
Product	pom	developer org	Apache Software Foundation	Low
Product	pom	developer org	Flow Logix	Low
Product	pom	developer org	Mobilization Labs	Low
Product	pom	developer org	SpringSource	Low
Product	pom	developer org	Stormpath	Low
Product	pom	developer org	Yupiik	Low
Product	pom	developer org URL	http://www.mobilizationlabs.com	Low
Product	pom	developer org URL	https://spring.io/	Low
Product	pom	developer org URL	https://stormpath.com/	Low
Product	pom	developer org URL	https://www.flowlogix.com/	Low
Product	pom	developer org URL	https://www.stormpath.com	Low
Product	pom	developer org URL	https://www.yupiik.com/	Low
Product	pom	groupid	org.apache.shiro	Highest
Product	pom	name	Apache Shiro :: Core	High
Product	pom	organization name	The Apache Software Foundation	Low
Product	pom	organization url	https://www.apache.org/	Low
Product	pom	parent-artifactid	shiro-root	Medium
Product	pom	url	https://shiro.apache.org/shiro-core/	Medium
Version	file	version	3.0.1	High
Version	Manifest	Bundle-Version	3.0.1	High
Version	Manifest	Implementation-Version	3.0.1	High
Version	pom	version	3.0.1	Highest

Related Dependencies

shiro-cache-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-cache/3.0.1/shiro-cache-3.0.1.jar
- MD5: a3e89969db7b15f8aff1df075f823b1b
- SHA1: 6174ec8b5044a6d2cc2b26443539e394705b6916
- SHA256: ed86487a2f5a1530d4781f1933be068d9ee1243378aaf8fcbc8ff950f594bc04
- pkg:maven/org.apache.shiro/shiro-cache@3.0.1
shiro-config-core-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-config-core/3.0.1/shiro-config-core-3.0.1.jar
- MD5: 427356ee0cb368d38bae74b2e2769f9c
- SHA1: 0b616f653dcf1632cef271b8e5420d2cfe7cb985
- SHA256: 057093af6ac9d09a43b2eb997a0aafe3e8a578eb5855c91055258197a316e8d9
- pkg:maven/org.apache.shiro/shiro-config-core@3.0.1
shiro-config-ogdl-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-config-ogdl/3.0.1/shiro-config-ogdl-3.0.1.jar
- MD5: be4d6c8d70107ef1d37a0f6bef17903a
- SHA1: 6829b451e9d9584a1869adf747fd9929906f1be2
- SHA256: b963339eb7f7c7d0c4d0b25bb3eadc572c355441c7e6fdbd45ac106c00c3c4cc
- pkg:maven/org.apache.shiro/shiro-config-ogdl@3.0.1
shiro-crypto-cipher-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-cipher/3.0.1/shiro-crypto-cipher-3.0.1.jar
- MD5: 8409c645b1c58bfa72f1adbe5cca71fa
- SHA1: ae60f8ae0a9eaffd28bebf57052097bc3edcbef4
- SHA256: f6cf863cffcf53b19bed89f2b04b985ae8eb544e8aeb9c1fcdc047cd61bc6904
- pkg:maven/org.apache.shiro/shiro-crypto-cipher@3.0.1
shiro-crypto-core-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-core/3.0.1/shiro-crypto-core-3.0.1.jar
- MD5: 30120175c05c1659cff65314a9a2012e
- SHA1: 7738704ebbc6cf6ab7fed9ce468464822e539e4a
- SHA256: cf49ae9ba6992fc54d372a5f485ccbc2f999786c0e8c3f4b122f9ea0b21ddccd
- pkg:maven/org.apache.shiro/shiro-crypto-core@3.0.1
shiro-crypto-hash-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-hash/3.0.1/shiro-crypto-hash-3.0.1.jar
- MD5: e19e8005d5f7dc854614aa0d80f4377e
- SHA1: 9264a7a882f1aadf74369564a0364c44b378b4b7
- SHA256: ef2599cecc743951bae68e69867d735310669a351106a44e2d6668f3fc91aa71
- pkg:maven/org.apache.shiro/shiro-crypto-hash@3.0.1
shiro-event-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-event/3.0.1/shiro-event-3.0.1.jar
- MD5: 654cb670b77b5253e0a7d2810b2361ad
- SHA1: 9fa3351e95c9f679cfe9984311637c41ba33da84
- SHA256: 9cdb815bba586a641cb245a12db2b53b03d6b57dc0aca9d9c97b1930f7c78c42
- pkg:maven/org.apache.shiro/shiro-event@3.0.1
shiro-hashes-argon2-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/crypto/shiro-hashes-argon2/3.0.1/shiro-hashes-argon2-3.0.1.jar
- MD5: 872a47f05d1bd70289e5da52d0bf07dc
- SHA1: 444c7f051ccea79dfdc67a3641d8e5a0f3261b9c
- SHA256: 19e8fdddaa41c30318fb345d7ded1b6e7f469456d58c6a5e16a53d4d45ee8030
- pkg:maven/org.apache.shiro.crypto/shiro-hashes-argon2@3.0.1
shiro-hashes-bcrypt-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/crypto/shiro-hashes-bcrypt/3.0.1/shiro-hashes-bcrypt-3.0.1.jar
- MD5: c09ad1aa3beffe5a232a0cf10ea8fcd0
- SHA1: d582f10b4343f8cc64fea3098b65283c428172d4
- SHA256: 95392a3a4eb4862cff10f01acef17a24aebae82fc05086bd973701a23a1230e3
- pkg:maven/org.apache.shiro.crypto/shiro-hashes-bcrypt@3.0.1
shiro-lang-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-lang/3.0.1/shiro-lang-3.0.1.jar
- MD5: 13ff885401cca31e3e78d307a6ace644
- SHA1: e7ad2208926a676f8fd369e15dcae930f386a956
- SHA256: 68c4a06321649f7c9d61a1d30595fb39dc4f9c16fbd7507529df58d611e44d96
- pkg:maven/org.apache.shiro/shiro-lang@3.0.1
shiro-web-3.0.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-web/3.0.1/shiro-web-3.0.1.jar
- MD5: 68c00999a52a95ba9465ef1a470fc89b
- SHA1: 406423fd167f3dea658129c7942c59558dd61fc3
- SHA256: effb8738ba95736de637f940aa18e7c0e3248f22e628dcf73fd4cf325a1fa297
- pkg:maven/org.apache.shiro/shiro-web@3.0.1

Identifiers

pkg:maven/org.apache.shiro/shiro-core@3.0.1 (Confidence:High)
cpe:2.3:a:apache:shiro:3.0.1:*:*:*:*:*:*:* (Confidence:Highest)

Description:

The slf4j API

License:

https://opensource.org/license/mit

File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.18/slf4j-api-2.0.18.jar
MD5: fe2837bd49bfb76657419002fed20ca9
SHA1: 78a9e7a37cd6360e0b818e86341b24123d28d4df
SHA256:44508fd1576500688c790b190acdd16fec4f8c79a3e0b900afd70503cf055f55
Referenced In Projects/Scopes:

waffle-demo-filter-jakarta:compile
waffle-demo-filter:compile
waffle-demo-parent-jakarta:compile
waffle-demo-parent:compile
waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form-jakarta:compile
waffle-demo-spring-form:compile
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile

pkg:maven/ch.qos.logback/logback-classic@1.6.3
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/org.slf4j/slf4j-simple@2.0.19

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	slf4j-api	High
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.slf4j.org	Low
Vendor	Manifest	bundle-symbolicname	slf4j.api	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	slf4j-api	Highest
Vendor	pom	artifactid	slf4j-api	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	SLF4J API Module	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	slf4j-api	High
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.slf4j.org	Low
Product	Manifest	Bundle-Name	SLF4J API Module	Medium
Product	Manifest	bundle-symbolicname	slf4j.api	Medium
Product	Manifest	Implementation-Title	slf4j-api	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	slf4j-api	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	SLF4J API Module	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	2.0.18	High
Version	Manifest	Bundle-Version	2.0.18	High
Version	Manifest	Implementation-Version	2.0.18	High
Version	pom	version	2.0.18	Highest

Identifiers

pkg:maven/org.slf4j/slf4j-api@2.0.18 (Confidence:High)

Description:

The slf4j API

License:

https://opensource.org/license/mit

File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.19/slf4j-api-2.0.19.jar
MD5: 1ca3a2acac3d5947b37d9b5536c55829
SHA1: efad9817997b3a6ce9e058f92e612917a744c290
SHA256:e91ff6d720609e7a194ffe758c3ed5c84e798617ae07b0a0f6a4fe229741b4bb
Referenced In Projects/Scopes:

waffle-demo-form-jakarta:compile
waffle-demo-form:compile
waffle-demo-jaas-jakarta:compile
waffle-demo-jaas:compile
waffle-demo-mixed-jakarta:compile
waffle-demo-mixed-post-jakarta:compile
waffle-demo-mixed-post:compile
waffle-demo-mixed:compile
waffle-demo-negotiate-jakarta:compile
waffle-demo-negotiate:compile
waffle-demo-spring-boot-filter2:compile
waffle-distro-jakarta:runtime
waffle-distro:runtime
waffle-jetty-jakarta:compile
waffle-jetty:compile
waffle-jna-jakarta:compile
waffle-jna:compile
waffle-shiro-jakarta:compile
waffle-shiro:compile
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile
waffle-spring-security5:compile
waffle-spring-security6:compile
waffle-spring-security7:compile
waffle-tests-jakarta:compile
waffle-tests:compile
waffle-tomcat10:compile
waffle-tomcat11:compile
waffle-tomcat9:compile

pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/org.slf4j/slf4j-simple@2.0.19

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	slf4j-api	High
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.slf4j.org	Low
Vendor	Manifest	bundle-symbolicname	slf4j.api	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	slf4j-api	Highest
Vendor	pom	artifactid	slf4j-api	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	SLF4J API Module	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	slf4j-api	High
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.slf4j.org	Low
Product	Manifest	Bundle-Name	SLF4J API Module	Medium
Product	Manifest	bundle-symbolicname	slf4j.api	Medium
Product	Manifest	Implementation-Title	slf4j-api	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	slf4j-api	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	SLF4J API Module	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	2.0.19	High
Version	Manifest	Bundle-Version	2.0.19	High
Version	Manifest	Implementation-Version	2.0.19	High
Version	pom	version	2.0.19	Highest

Identifiers

pkg:maven/org.slf4j/slf4j-api@2.0.19 (Confidence:High)

Description:

SLF4J Simple Provider

License:

https://opensource.org/license/mit

File Path: /home/runner/.m2/repository/org/slf4j/slf4j-simple/2.0.19/slf4j-simple-2.0.19.jar
MD5: b36bba5fb90a342081e46cc006c039ec
SHA1: 61c4ac1c4f20de57d3820493c91a7af41eccb778
SHA256:1d20cbfc8f97a719112a72c6d4c2323259d179a7478d1f694b54409d412bb731
Referenced In Projects/Scopes:

waffle-jna-jakarta:compile
waffle-jna:compile

pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	slf4j-simple	High
Vendor	jar	package name	simple	Highest
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.slf4j.org	Low
Vendor	Manifest	bundle-symbolicname	slf4j.simple	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="org.slf4j.spi.SLF4JServiceProvider";type=simple;effective:=active,osgi.serviceloader;osgi.serviceloader="org.slf4j.spi.SLF4JServiceProvider";register:="org.slf4j.simple.SimpleServiceProvider";type=simple	Low
Vendor	pom	artifactid	slf4j-simple	Highest
Vendor	pom	artifactid	slf4j-simple	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	SLF4J Simple Provider	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	slf4j-simple	High
Product	jar	package name	9	Highest
Product	jar	package name	simple	Highest
Product	jar	package name	simpleserviceprovider	Highest
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.slf4j.org	Low
Product	Manifest	Bundle-Name	SLF4J Simple Provider	Medium
Product	Manifest	bundle-symbolicname	slf4j.simple	Medium
Product	Manifest	Implementation-Title	slf4j-simple	High
Product	Manifest	multi-release	true	Low
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin 5.1.9	Low
Product	Manifest	provide-capability	osgi.service;objectClass:List="org.slf4j.spi.SLF4JServiceProvider";type=simple;effective:=active,osgi.serviceloader;osgi.serviceloader="org.slf4j.spi.SLF4JServiceProvider";register:="org.slf4j.simple.SimpleServiceProvider";type=simple	Low
Product	pom	artifactid	slf4j-simple	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	SLF4J Simple Provider	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	2.0.19	High
Version	Manifest	Bundle-Version	2.0.19	High
Version	Manifest	Implementation-Version	2.0.19	High
Version	pom	version	2.0.19	Highest

Identifiers

pkg:maven/org.slf4j/slf4j-simple@2.0.19 (Confidence:High)

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.4/snakeyaml-2.4.jar
MD5: 29410ee3a987e3bff7b847933c591972
SHA1: e0666b825b796f85521f02360e77f4c92c5a7a07
SHA256:ef779af5d29a9dde8cc70ce0341f5c6f7735e23edff9685ceaa9d35359b7bb7f
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	snakeyaml	High
Vendor	jar	package name	emitter	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	parser	Highest
Vendor	jar	package name	snakeyaml	Highest
Vendor	jar	package name	yaml	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.yaml.snakeyaml	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	snakeyaml	Highest
Vendor	pom	artifactid	snakeyaml	Low
Vendor	pom	developer email	alexander.maslov@gmail.com	Low
Vendor	pom	developer email	public.somov@gmail.com	Low
Vendor	pom	developer id	asomov	Medium
Vendor	pom	developer id	maslovalex	Medium
Vendor	pom	developer name	Alexander Maslov	Medium
Vendor	pom	developer name	Andrey Somov	Medium
Vendor	pom	groupid	org.yaml	Highest
Vendor	pom	name	SnakeYAML	High
Vendor	pom	url	https://bitbucket.org/snakeyaml/snakeyaml	Highest
Product	file	name	snakeyaml	High
Product	jar	package name	emitter	Highest
Product	jar	package name	org	Highest
Product	jar	package name	parser	Highest
Product	jar	package name	snakeyaml	Highest
Product	jar	package name	yaml	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	SnakeYAML	Medium
Product	Manifest	bundle-symbolicname	org.yaml.snakeyaml	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	snakeyaml	Highest
Product	pom	developer email	alexander.maslov@gmail.com	Low
Product	pom	developer email	public.somov@gmail.com	Low
Product	pom	developer id	asomov	Low
Product	pom	developer id	maslovalex	Low
Product	pom	developer name	Alexander Maslov	Low
Product	pom	developer name	Andrey Somov	Low
Product	pom	groupid	org.yaml	Highest
Product	pom	name	SnakeYAML	High
Product	pom	url	https://bitbucket.org/snakeyaml/snakeyaml	Medium
Version	file	version	2.4	High
Version	pom	version	2.4	Highest

Identifiers

pkg:maven/org.yaml/snakeyaml@2.4 (Confidence:High)
cpe:2.3:a:snakeyaml_project:snakeyaml:2.4:*:*:*:*:*:*:* (Confidence:Highest)

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.6/snakeyaml-2.6.jar
MD5: d8bd94536cee962cfff39730bffdb8da
SHA1: 2bc14918a2f8d5414749ab12d0c590cd3198b8c1
SHA256:c8f7a98e7394adda02f6317249710e4d1b4c7a25aa8c7eace0c2eea52eb8bf85
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-security@4.1.1
pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	snakeyaml	High
Vendor	jar	package name	emitter	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	parser	Highest
Vendor	jar	package name	snakeyaml	Highest
Vendor	jar	package name	yaml	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.yaml.snakeyaml	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	snakeyaml	Highest
Vendor	pom	artifactid	snakeyaml	Low
Vendor	pom	developer email	alexander.maslov@gmail.com	Low
Vendor	pom	developer email	public.somov@gmail.com	Low
Vendor	pom	developer id	asomov	Medium
Vendor	pom	developer id	maslovalex	Medium
Vendor	pom	developer name	Alexander Maslov	Medium
Vendor	pom	developer name	Andrey Somov	Medium
Vendor	pom	groupid	org.yaml	Highest
Vendor	pom	name	SnakeYAML	High
Vendor	pom	url	https://bitbucket.org/snakeyaml/snakeyaml	Highest
Product	file	name	snakeyaml	High
Product	jar	package name	emitter	Highest
Product	jar	package name	org	Highest
Product	jar	package name	parser	Highest
Product	jar	package name	snakeyaml	Highest
Product	jar	package name	yaml	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	SnakeYAML	Medium
Product	Manifest	bundle-symbolicname	org.yaml.snakeyaml	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	snakeyaml	Highest
Product	pom	developer email	alexander.maslov@gmail.com	Low
Product	pom	developer email	public.somov@gmail.com	Low
Product	pom	developer id	asomov	Low
Product	pom	developer id	maslovalex	Low
Product	pom	developer name	Alexander Maslov	Low
Product	pom	developer name	Andrey Somov	Low
Product	pom	groupid	org.yaml	Highest
Product	pom	name	SnakeYAML	High
Product	pom	url	https://bitbucket.org/snakeyaml/snakeyaml	Medium
Version	file	version	2.6	High
Version	pom	version	2.6	Highest

Identifiers

pkg:maven/org.yaml/snakeyaml@2.6 (Confidence:High)
cpe:2.3:a:snakeyaml_project:snakeyaml:2.6:*:*:*:*:*:*:* (Confidence:Highest)

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.7/snakeyaml-2.7.jar
MD5: 179e0dcff5597d5fde6e343bec228d96
SHA1: 47713fda569f07641538ff7f2fa9cb3ead4603e5
SHA256:2e194eba45a67dee19a4e272f4a04b18de8054e9f598b094382f6dae0b0e4b5e
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	snakeyaml	High
Vendor	jar	package name	emitter	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	parser	Highest
Vendor	jar	package name	snakeyaml	Highest
Vendor	jar	package name	yaml	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.yaml.snakeyaml	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	snakeyaml	Highest
Vendor	pom	artifactid	snakeyaml	Low
Vendor	pom	developer email	alexander.maslov@gmail.com	Low
Vendor	pom	developer email	public.somov@gmail.com	Low
Vendor	pom	developer id	asomov	Medium
Vendor	pom	developer id	maslovalex	Medium
Vendor	pom	developer name	Alexander Maslov	Medium
Vendor	pom	developer name	Andrey Somov	Medium
Vendor	pom	groupid	org.yaml	Highest
Vendor	pom	name	SnakeYAML	High
Vendor	pom	url	https://codeberg.org/snakeyaml/snakeyaml	Highest
Product	file	name	snakeyaml	High
Product	jar	package name	emitter	Highest
Product	jar	package name	org	Highest
Product	jar	package name	parser	Highest
Product	jar	package name	snakeyaml	Highest
Product	jar	package name	yaml	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	SnakeYAML	Medium
Product	Manifest	bundle-symbolicname	org.yaml.snakeyaml	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	snakeyaml	Highest
Product	pom	developer email	alexander.maslov@gmail.com	Low
Product	pom	developer email	public.somov@gmail.com	Low
Product	pom	developer id	asomov	Low
Product	pom	developer id	maslovalex	Low
Product	pom	developer name	Alexander Maslov	Low
Product	pom	developer name	Andrey Somov	Low
Product	pom	groupid	org.yaml	Highest
Product	pom	name	SnakeYAML	High
Product	pom	url	https://codeberg.org/snakeyaml/snakeyaml	Medium
Version	file	version	2.7	High
Version	pom	version	2.7	Highest

Identifiers

pkg:maven/org.yaml/snakeyaml@2.7 (Confidence:High)
cpe:2.3:a:snakeyaml_project:snakeyaml:2.7:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: /home/runner/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.10.4/spotbugs-annotations-4.10.4.jar
MD5: 472925cb4e5451c8f7a1aeeefe286622
SHA1: 7eb4c58212378becfb6ea6d236ec24a2352a316e
SHA256:28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3
Referenced In Projects/Scopes:

waffle-bom-jakarta:provided
waffle-bom:provided
waffle-demo-filter-jakarta:provided
waffle-demo-filter:provided
waffle-demo-form-jakarta:provided
waffle-demo-form:provided
waffle-demo-jaas-jakarta:provided
waffle-demo-jaas:provided
waffle-demo-mixed-jakarta:provided
waffle-demo-mixed-post-jakarta:provided
waffle-demo-mixed-post:provided
waffle-demo-mixed:provided
waffle-demo-negotiate-jakarta:provided
waffle-demo-negotiate:provided
waffle-demo-parent-jakarta:provided
waffle-demo-parent:provided
waffle-demo-spring-boot-filter2:provided
waffle-demo-spring-boot-filter3:provided
waffle-demo-spring-boot-filter4:provided
waffle-demo-spring-filter-jakarta:provided
waffle-demo-spring-filter:provided
waffle-demo-spring-form-jakarta:provided
waffle-demo-spring-form:provided
waffle-distro-jakarta:provided
waffle-distro:provided
waffle-jetty-jakarta:provided
waffle-jetty:provided
waffle-jna-jakarta:provided
waffle-jna:provided
waffle-shiro-jakarta:provided
waffle-shiro:provided
waffle-spring-boot-autoconfigure2:provided
waffle-spring-boot-autoconfigure3:provided
waffle-spring-boot-autoconfigure4:provided
waffle-spring-boot-starter2:provided
waffle-spring-boot-starter3:provided
waffle-spring-boot-starter4:provided
waffle-spring-boot2:provided
waffle-spring-boot3:provided
waffle-spring-boot4:provided
waffle-spring-security5:provided
waffle-spring-security6:provided
waffle-spring-security7:provided
waffle-tests-jakarta:provided
waffle-tests:provided
waffle-tomcat10:provided
waffle-tomcat11:provided
waffle-tomcat9:provided
waffle:provided

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-jaas-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-mixed-post-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-negotiate-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-parent-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-form-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-jaas@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed-post@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-mixed@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-negotiate@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-parent@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-filter@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle.demo/waffle-demo-spring-form@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-bom@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-distro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jetty@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-boot4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests-jakarta@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tests@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat10@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat11@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-tomcat9@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.10.4	High
Version	Manifest	Bundle-Version	4.10.4	High
Version	pom	version	4.10.4	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4 (Confidence:High)

Description:

Spring Boot

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot/2.7.18/spring-boot-2.7.18.jar
MD5: 0941c83c25204150f8bd73ae66c63fd1
SHA1: f6dbdd8da7c2bded63dff9b1f48d01a4923f20a0
SHA256:530f4e0fdfeb3a0e2b3a369d15cdea38fbdc1696f8b030c35a6ad65c27524950
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-boot	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	boot	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.boot	Medium
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	pom	artifactid	spring-boot	Highest
Vendor	pom	artifactid	spring-boot	Low
Vendor	pom	developer email	ask@spring.io	Low
Vendor	pom	developer name	Spring	Medium
Vendor	pom	developer org	VMware, Inc.	Medium
Vendor	pom	developer org URL	https://www.spring.io	Medium
Vendor	pom	groupid	org.springframework.boot	Highest
Vendor	pom	name	spring-boot	High
Vendor	pom	organization name	VMware, Inc.	High
Vendor	pom	organization url	https://spring.io	Medium
Vendor	pom	url	https://spring.io/projects/spring-boot	Highest
Product	file	name	spring-boot	High
Product	jar	package name	boot	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.boot	Medium
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	Implementation-Title	Spring Boot	High
Product	pom	artifactid	spring-boot	Highest
Product	pom	developer email	ask@spring.io	Low
Product	pom	developer name	Spring	Low
Product	pom	developer org	VMware, Inc.	Low
Product	pom	developer org URL	https://www.spring.io	Low
Product	pom	groupid	org.springframework.boot	Highest
Product	pom	name	spring-boot	High
Product	pom	organization name	VMware, Inc.	Low
Product	pom	organization url	https://spring.io	Low
Product	pom	url	https://spring.io/projects/spring-boot	Medium
Version	file	version	2.7.18	High
Version	Manifest	Implementation-Version	2.7.18	High
Version	pom	version	2.7.18	Highest

Related Dependencies

spring-boot-autoconfigure-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-autoconfigure/2.7.18/spring-boot-autoconfigure-2.7.18.jar
- MD5: e127e4ed0469cc5442d3c8e5e42e7988
- SHA1: 9cf147c6ca274c75b32556acdcba5a1de081ebcd
- SHA256: 1c4e0aadcb662b6149b536a2cf288003ffefe81a6cc69846e9f14976529a1b08
- pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.18
spring-boot-configuration-processor-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-configuration-processor/2.7.18/spring-boot-configuration-processor-2.7.18.jar
- MD5: 46f23c11c49166214396335e16ae3f45
- SHA1: 899128018a7962b3e4be665910bae65dff08d1b0
- SHA256: 79dc3480e94fe708b817097ee2745f8b1c19d650ce6ddd153c2f2ab068674dea
- pkg:maven/org.springframework.boot/spring-boot-configuration-processor@2.7.18
spring-boot-starter-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter/2.7.18/spring-boot-starter-2.7.18.jar
- MD5: 03fc89fcd959a332de7cdc22e6bdc60d
- SHA1: e56b75105f9ace6df154fd47eeeeadc2f5791e56
- SHA256: f67a5d913defa764295b6a0d8d13573624e437eb34e97d88c0e76bf181656071
- pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18
spring-boot-starter-json-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-json/2.7.18/spring-boot-starter-json-2.7.18.jar
- MD5: 4227a48b68fbd7fb37dd079ad3217226
- SHA1: b6d9ed5cae0c1929a9e561bf4799a3dc93a10db1
- SHA256: 084f592d522dfa36790fe08d4d0b9cebe6683638889834ed2f885f3c42fecbf6
- pkg:maven/org.springframework.boot/spring-boot-starter-json@2.7.18
spring-boot-starter-logging-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-logging/2.7.18/spring-boot-starter-logging-2.7.18.jar
- MD5: b812106a59ea242570f1c55d71982495
- SHA1: 19f7c255ba5255116f58c3bbaf52c7b88ea6af3e
- SHA256: 202c0894dbfdeff7be005597ff98288133a62fe7f5593be4938400482d19dcb7
- pkg:maven/org.springframework.boot/spring-boot-starter-logging@2.7.18
spring-boot-starter-security-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-security/2.7.18/spring-boot-starter-security-2.7.18.jar
- MD5: f0461734fe73c8f250012d453cb4fb12
- SHA1: 5d29a712fd0a5d7b77e348b660e2c0885b215bc4
- SHA256: 075ee2311819e7076278f3f6321bca21447ee52db62ca000caf17132b37c986a
- pkg:maven/org.springframework.boot/spring-boot-starter-security@2.7.18
spring-boot-starter-tomcat-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-tomcat/2.7.18/spring-boot-starter-tomcat-2.7.18.jar
- MD5: c2080ad5020671b7884b9564006bd09c
- SHA1: c56e50e006448e75a8bde595dbc754ba294389af
- SHA256: e4a44478556749137f28001c35d897efff31f39161606589cc355dcbf797c6f0
- pkg:maven/org.springframework.boot/spring-boot-starter-tomcat@2.7.18
spring-boot-starter-web-2.7.18.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-web/2.7.18/spring-boot-starter-web-2.7.18.jar
- MD5: e0bfe77aa7415f3b86d70d41cf425ccd
- SHA1: 0dd62ea85098187b4604e78dc15a7ff87dba173d
- SHA256: a74fab5f826b600e3c3f4cd7028c5c982b0bf1b849673629cbb758ae790a4c08
- pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Identifiers

pkg:maven/org.springframework.boot/spring-boot@2.7.18 (Confidence:High)
cpe:2.3:a:vmware:spring_boot:2.7.18:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-40974

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22733

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

CWE-288 Authentication Bypass Using an Alternate Path or Channel

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-40972

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

CWE-208 Observable Timing Discrepancy

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-40975

Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://access.redhat.com/errata/RHSA-2026:17668
0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://access.redhat.com/errata/RHSA-2026:21772
0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://access.redhat.com/errata/RHSA-2026:22619
0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://access.redhat.com/errata/RHSA-2026:25089
0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://access.redhat.com/security/cve/CVE-2026-40975
0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://bugzilla.redhat.com/show_bug.cgi?id=2463331
0b0ca135-0b70-47e7-9f44-1890c2a1c46c - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40975.json
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-40973

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.

CWE-377 Insecure Temporary File

CVSSv3:

Base Score: HIGH (7.0)
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-40977

When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CVSSv3:

Base Score: MEDIUM (6.7)
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41001

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.

Affected versions:
Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.

CWE-377 Insecure Temporary File

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Boot

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot/3.5.16/spring-boot-3.5.16.jar
MD5: 7a7ad5afd579e7a5b871dd29bf3ff406
SHA1: 8e75e8d0d3cfbca088774df8d30b45bbd21e5d99
SHA256:2d5b16632402b840b0425ed52610071890bf8cb24c6c49af343bbde574123265
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile

pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-boot	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	boot	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.boot	Medium
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	pom	artifactid	spring-boot	Highest
Vendor	pom	artifactid	spring-boot	Low
Vendor	pom	developer email	ask@spring.io	Low
Vendor	pom	developer name	Spring	Medium
Vendor	pom	developer org	VMware, Inc.	Medium
Vendor	pom	developer org URL	https://www.spring.io	Medium
Vendor	pom	groupid	org.springframework.boot	Highest
Vendor	pom	name	spring-boot	High
Vendor	pom	organization name	VMware, Inc.	High
Vendor	pom	organization url	https://spring.io	Medium
Vendor	pom	url	https://spring.io/projects/spring-boot	Highest
Product	file	name	spring-boot	High
Product	jar	package name	boot	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.boot	Medium
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	Implementation-Title	Spring Boot	High
Product	pom	artifactid	spring-boot	Highest
Product	pom	developer email	ask@spring.io	Low
Product	pom	developer name	Spring	Low
Product	pom	developer org	VMware, Inc.	Low
Product	pom	developer org URL	https://www.spring.io	Low
Product	pom	groupid	org.springframework.boot	Highest
Product	pom	name	spring-boot	High
Product	pom	organization name	VMware, Inc.	Low
Product	pom	organization url	https://spring.io	Low
Product	pom	url	https://spring.io/projects/spring-boot	Medium
Version	file	version	3.5.16	High
Version	Manifest	Implementation-Version	3.5.16	High
Version	pom	version	3.5.16	Highest

Related Dependencies

spring-boot-autoconfigure-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-autoconfigure/3.5.16/spring-boot-autoconfigure-3.5.16.jar
- MD5: 456df6ce6ce9901dc7239a2ccd7b5eee
- SHA1: 87db09240595b49b530b230252311836abd21df1
- SHA256: 0198331231e9bf872a135741d59c6d1f9e9007ff207a1ca910179c550bb12bfc
- pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16
spring-boot-configuration-processor-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-configuration-processor/3.5.16/spring-boot-configuration-processor-3.5.16.jar
- MD5: 0b73b5f89add162cbe59f67b3dbbd860
- SHA1: fa1259e353a03c0e70c7b8017fbd05fbc738296f
- SHA256: 34dcf76ac251f41af3198398350e50194d81020329a9aad0658538bbf80c3845
- pkg:maven/org.springframework.boot/spring-boot-configuration-processor@3.5.16
spring-boot-starter-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter/3.5.16/spring-boot-starter-3.5.16.jar
- MD5: a9bedef81badcc7696680d69aadef61e
- SHA1: d38b3f624f867a7d1e7f72a7adb193f6d4111114
- SHA256: 649da4576c83a4f814222dcff067cd774eeeb1119e790390eaeab8e9955d0d44
- pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16
spring-boot-starter-json-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-json/3.5.16/spring-boot-starter-json-3.5.16.jar
- MD5: 1335561c4d84c3c854d234a0dc772763
- SHA1: 5840614f0a4371809023d7409b5ee132f686e55a
- SHA256: be8340bdd87d5e76bfec5b3b256bb923c841464793e5a8e2f7e8ced37e6eb434
- pkg:maven/org.springframework.boot/spring-boot-starter-json@3.5.16
spring-boot-starter-logging-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-logging/3.5.16/spring-boot-starter-logging-3.5.16.jar
- MD5: f7403bc79d5914196bfd62efd4a4115e
- SHA1: 18df7a243be45f11ee346cdd4d7b84d377917a2e
- SHA256: f761d56f6693a47e6cccca8e9202c716ab954ccdf7440e1fccc0cb50c661eeb8
- pkg:maven/org.springframework.boot/spring-boot-starter-logging@3.5.16
spring-boot-starter-security-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-security/3.5.16/spring-boot-starter-security-3.5.16.jar
- MD5: 50481913461e9fdb61cd0f73283cba9a
- SHA1: b32c27a95316b69df761455c6f29d30ecaba07f2
- SHA256: 826a677535c3a3a37c242c2de8061f2ecafb34d449ba1c5988079733dcb6d65d
- pkg:maven/org.springframework.boot/spring-boot-starter-security@3.5.16
spring-boot-starter-tomcat-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-tomcat/3.5.16/spring-boot-starter-tomcat-3.5.16.jar
- MD5: a387774e6aaf92adc4bb90aa48b62085
- SHA1: e76d97eb7710f95feaa82c9cf2fa74cc78acc64d
- SHA256: c3bc33205b0a46faab33dcdf743958e845ee94e1f7961bbe0e0f8ce881db747b
- pkg:maven/org.springframework.boot/spring-boot-starter-tomcat@3.5.16
spring-boot-starter-web-3.5.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-web/3.5.16/spring-boot-starter-web-3.5.16.jar
- MD5: 64ed509c59fb81442d28a42381f6b7b1
- SHA1: 5c30cb2a0a69e25a8fc402d22e171dbca7b49278
- SHA256: 3272f145a6edd94896c60fba7d2a05b525c78f8efd0172e7bffb6c3b9857762e
- pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

pkg:maven/org.springframework.boot/spring-boot@3.5.16 (Confidence:High)
cpe:2.3:a:vmware:spring_boot:3.5.16:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Spring Boot Web Server

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-web-server/4.1.1/spring-boot-web-server-4.1.1.jar
MD5: a060efd710429298574e5f7615e4f6df
SHA1: d1eb8e523013ac3939ae59adc5335a3de704d11b
SHA256:6912fb1fdf7f657a61ac050760fa835fb1e7496399291697e2901f82887a4fee
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-boot-web-server	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	boot	Highest
Vendor	jar	package name	server	Highest
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	web	Highest
Vendor	Manifest	automatic-module-name	spring.boot.web.server	Medium
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	pom	artifactid	spring-boot-web-server	Highest
Vendor	pom	artifactid	spring-boot-web-server	Low
Vendor	pom	developer email	ask@spring.io	Low
Vendor	pom	developer name	Spring	Medium
Vendor	pom	developer org	VMware, Inc.	Medium
Vendor	pom	developer org URL	https://www.spring.io	Medium
Vendor	pom	groupid	org.springframework.boot	Highest
Vendor	pom	name	spring-boot-web-server	High
Vendor	pom	organization name	VMware, Inc.	High
Vendor	pom	organization url	https://spring.io	Medium
Vendor	pom	url	https://spring.io/projects/spring-boot	Highest
Product	file	name	spring-boot-web-server	High
Product	jar	package name	boot	Highest
Product	jar	package name	server	Highest
Product	jar	package name	springframework	Highest
Product	jar	package name	web	Highest
Product	Manifest	automatic-module-name	spring.boot.web.server	Medium
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	Implementation-Title	Spring Boot Web Server	High
Product	pom	artifactid	spring-boot-web-server	Highest
Product	pom	developer email	ask@spring.io	Low
Product	pom	developer name	Spring	Low
Product	pom	developer org	VMware, Inc.	Low
Product	pom	developer org URL	https://www.spring.io	Low
Product	pom	groupid	org.springframework.boot	Highest
Product	pom	name	spring-boot-web-server	High
Product	pom	organization name	VMware, Inc.	Low
Product	pom	organization url	https://spring.io	Low
Product	pom	url	https://spring.io/projects/spring-boot	Medium
Version	file	version	4.1.1	High
Version	Manifest	Implementation-Version	4.1.1	High
Version	pom	version	4.1.1	Highest

Related Dependencies

spring-boot-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot/4.1.1/spring-boot-4.1.1.jar
- MD5: 81b5253239da3bbee07178a6c28bd9d4
- SHA1: f958dfcba9bc998459cd7862894aa69220645c44
- SHA256: 0d92b532b1d4020640e72d78c31af175c23db8e0ddd45b81855b7fdf4c9c70f0
- pkg:maven/org.springframework.boot/spring-boot@4.1.1
spring-boot-autoconfigure-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-autoconfigure/4.1.1/spring-boot-autoconfigure-4.1.1.jar
- MD5: bdae3903f86e1ce179fc0da467594b14
- SHA1: 53c1c604301b4183faa480a5b9f2fd86a2f043c3
- SHA256: 59228756ddd76cea050f95d86deff334789bc53b6688beaa673b1af2b9794592
- pkg:maven/org.springframework.boot/spring-boot-autoconfigure@4.1.1
spring-boot-configuration-processor-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-configuration-processor/4.1.1/spring-boot-configuration-processor-4.1.1.jar
- MD5: 0ad0bf0a2fc64fb4ad4437959e7269e1
- SHA1: af11d86c263f1ea22d63a05f5cac733c005cf899
- SHA256: 01e4b478a9daf376f5b55d407aa3e8433cc99b76e78a10c88235674b30232e50
- pkg:maven/org.springframework.boot/spring-boot-configuration-processor@4.1.1
spring-boot-http-converter-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-http-converter/4.1.1/spring-boot-http-converter-4.1.1.jar
- MD5: dca1f4468f453cd12fd3497d5ad7ed22
- SHA1: 886e76307151a64c8710c61e02a2323ab883b87c
- SHA256: 52a167430a918c223b2ccd2eb62aff91a8e43e6daebe5a07caa37b9a04c61cb9
- pkg:maven/org.springframework.boot/spring-boot-http-converter@4.1.1
spring-boot-jackson-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-jackson/4.1.1/spring-boot-jackson-4.1.1.jar
- MD5: 25cf1458df4244b5d1e583ceffab5f2e
- SHA1: 1defff7e3f9dda050f26e98da3285b4321920dc1
- SHA256: 69a9b4d8850a0532a5e44ff7306a03621485b26596e7f9481de7d28e68a2dd42
- pkg:maven/org.springframework.boot/spring-boot-jackson@4.1.1
spring-boot-security-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-security/4.1.1/spring-boot-security-4.1.1.jar
- MD5: f32cab4e9825bc63d15fd6c5e4cd6f1d
- SHA1: 8f08145264d1a224c4b9c865d60e47f62f4dd85f
- SHA256: c940697be9bc67820d5011b86d58105836b7cae7c8fb5d4e61d635b51b392cbe
- pkg:maven/org.springframework.boot/spring-boot-security@4.1.1
spring-boot-servlet-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-servlet/4.1.1/spring-boot-servlet-4.1.1.jar
- MD5: d496b25e22cd17f4f89e6a54a1f9b6f7
- SHA1: 76881b573c8639708ce3d520b428209335f007fc
- SHA256: 4dcb156e311a4c1ad5f1ed7eabd94a78ea74510b05c429a4fcfdcf8beb9d5882
- pkg:maven/org.springframework.boot/spring-boot-servlet@4.1.1
spring-boot-starter-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter/4.1.1/spring-boot-starter-4.1.1.jar
- MD5: 5d5008acc9638eca189bbcd581e164b3
- SHA1: 50fe6a89fa4fd26e7caaec909ab1c4cc9afde5d4
- SHA256: de5b2dd28400eda20914fd4a6054d0c201e68d2e4de35a25a4d89f054ccc2e63
- pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1
spring-boot-starter-jackson-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-jackson/4.1.1/spring-boot-starter-jackson-4.1.1.jar
- MD5: 5dad3d4002b15cc88586263d4224a82e
- SHA1: f8cd6a81994a207a808564515e5104548d1967bb
- SHA256: d30e594a3e0f3a090438fc22000a87ab577a3b80c674180a10544ca331207f24
- pkg:maven/org.springframework.boot/spring-boot-starter-jackson@4.1.1
spring-boot-starter-logging-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-logging/4.1.1/spring-boot-starter-logging-4.1.1.jar
- MD5: d7cf74c5bba2267508f0bfafd374c367
- SHA1: c6831fe833182419def54db4c41fc34ce71f4fc5
- SHA256: 8eca7d72c8434f5c3b935385c656cd5337f473434bdbcb4913b3b3a34897d178
- pkg:maven/org.springframework.boot/spring-boot-starter-logging@4.1.1
spring-boot-starter-security-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-security/4.1.1/spring-boot-starter-security-4.1.1.jar
- MD5: 1d540ab506986647dc85fca9b6230f24
- SHA1: 6c8b67269e28642ac532a85fec1ea159847ab602
- SHA256: 38628875b75cbed6ba4642f3b0a4baf4735bd4f82b49450e4ae5a5e4d1b7b4a9
- pkg:maven/org.springframework.boot/spring-boot-starter-security@4.1.1
spring-boot-starter-tomcat-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-tomcat/4.1.1/spring-boot-starter-tomcat-4.1.1.jar
- MD5: da4fd524d53460ee9872627f37d82955
- SHA1: 8a7b2b2fd2ec40ed7e56359fb68c9a8b5fde315c
- SHA256: f224d8504be3b413825ee85ef549a7b1598ee8512e062c6bd5ddce1043cd388a
- pkg:maven/org.springframework.boot/spring-boot-starter-tomcat@4.1.1
spring-boot-starter-tomcat-runtime-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-tomcat-runtime/4.1.1/spring-boot-starter-tomcat-runtime-4.1.1.jar
- MD5: 8bf74fd310649fcc3fadd2ae63ef33e7
- SHA1: 0397ae80a471fa432ef858230c7d52498ee20ecd
- SHA256: 580f0d9a9d02a1a6e387640e422af42f9dbdf302836d562ec595fdb2b31a1c29
- pkg:maven/org.springframework.boot/spring-boot-starter-tomcat-runtime@4.1.1
spring-boot-starter-web-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-starter-web/4.1.1/spring-boot-starter-web-4.1.1.jar
- MD5: 458186b1220acdb0d5ddcc644782fbfd
- SHA1: e26041af0e4abd0219452f7cffbf70782f6b2667
- SHA256: 840d2ccfa8945bbbde526121f7bbbc075b98c816fec188c0c5f89b7b05be5e21
- pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1
spring-boot-tomcat-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-tomcat/4.1.1/spring-boot-tomcat-4.1.1.jar
- MD5: f6af30cb7f976f9ffb40870d546dfe97
- SHA1: 61450290ced8f16d8d00308f1aa81423d7660dc2
- SHA256: 17f65629e4eb3c979c0572b69b57d630bb12e64869e9d7520adddaa6734256b6
- pkg:maven/org.springframework.boot/spring-boot-tomcat@4.1.1
spring-boot-webmvc-4.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-webmvc/4.1.1/spring-boot-webmvc-4.1.1.jar
- MD5: c2ab42be73e47c4389f6605ede5f24b2
- SHA1: 3057d155bc66412ad906ecdd488e0fd617589151
- SHA256: 9f08c1fb938c45a8693fec5f3065be3aca203948a7ab4d56b06444986f75a6b2
- pkg:maven/org.springframework.boot/spring-boot-webmvc@4.1.1

Identifiers

pkg:maven/org.springframework.boot/spring-boot-web-server@4.1.1 (Confidence:High)
cpe:2.3:a:vmware:spring_boot:4.1.1:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/spring-core/5.3.39/spring-core-5.3.39.jar
MD5: 632d2a8c30962a69273775968c052651
SHA1: d2bff2eedf27b51d6ef9a2fc892aaff5b7a768dd
SHA256:3a1ddcf05420a9181bd9cacb6062a3edc493e14d555961ad50e1a6360eb1e75f
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile
waffle-spring-security5:compile

pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.core	Medium
Vendor	pom	artifactid	spring-core	Highest
Vendor	pom	artifactid	spring-core	Low
Vendor	pom	developer email	jhoeller@pivotal.io	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Core	High
Vendor	pom	organization name	Spring IO	High
Vendor	pom	organization url	https://spring.io/projects/spring-framework	Medium
Vendor	pom	url	spring-projects/spring-framework	Highest
Product	file	name	spring-core	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	core	Highest
Product	jar	package name	io	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.core	Medium
Product	Manifest	Implementation-Title	spring-core	High
Product	pom	artifactid	spring-core	Highest
Product	pom	developer email	jhoeller@pivotal.io	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Core	High
Product	pom	organization name	Spring IO	Low
Product	pom	organization url	https://spring.io/projects/spring-framework	Low
Product	pom	url	spring-projects/spring-framework	High
Version	file	version	5.3.39	High
Version	Manifest	Implementation-Version	5.3.39	High
Version	pom	version	5.3.39	Highest

Related Dependencies

spring-aop-5.3.39.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-aop/5.3.39/spring-aop-5.3.39.jar
- MD5: 47ef8946ec3f2f76f83cda172b9fd964
- SHA1: 3af1f0d73ec1e031c7083c848342989f413ca275
- SHA256: aa706e4f749982c0bae5fa637433c44c24f0fff5d16dc41deea6d30c3dfa7c85
- pkg:maven/org.springframework/spring-aop@5.3.39
spring-beans-5.3.39.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-beans/5.3.39/spring-beans-5.3.39.jar
- MD5: c2f99040fb8b0bc98515c87b968227d3
- SHA1: 87770ce736cbd777c07866cbc8a06b879765e3c8
- SHA256: b6697a5d8facb81aa75e5a46d959d4256da9ce3b40d33f3b5bbd42a8b1ed5722
- pkg:maven/org.springframework/spring-beans@5.3.39
spring-context-5.3.39.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-context/5.3.39/spring-context-5.3.39.jar
- MD5: 167e95de6f9de58b1ffff09990237021
- SHA1: 286538ca4b3890192d63c88fdd1616adde17dc0e
- SHA256: 9e644fc33bece9a9cb82538167a1b9640ae7b7d80252e893d89b8926a2f81633
- pkg:maven/org.springframework/spring-context@5.3.39
spring-expression-5.3.39.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-expression/5.3.39/spring-expression-5.3.39.jar
- MD5: 41198683f2d488b4b2038b7d8e4b6d81
- SHA1: 25cf07399eb7ac3fc13888b20dc4d67124ec75bd
- SHA256: d5337774d889fcdc9c08b0c8b8aaa1018d4c95b9b441db0118f7ae4d328f2810
- pkg:maven/org.springframework/spring-expression@5.3.39
spring-webmvc-5.3.39.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-webmvc/5.3.39/spring-webmvc-5.3.39.jar
- MD5: 7f428d04938f7d65077db3e269ca0d78
- SHA1: 89c465ff3d37629a60e1ad4886f61a09a459d639
- SHA256: 1ad8a2ba468c07024ba63cb7681bb30a2ecf8d91124f00fdb4a3d184131b87ed
- pkg:maven/org.springframework/spring-webmvc@5.3.39

Identifiers

pkg:maven/org.springframework/spring-core@5.3.39 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:5.3.39:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:5.3.39:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:5.3.39:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-41855

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-502 Deserialization of Untrusted Data

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47884

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59283

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-913 Improper Control of Dynamically-Managed Code Resources

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41842

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41848

Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-1333 Inefficient Regular Expression Complexity

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41849

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).

Affected versions:
Spring Framework 5.3.0 through 5.3.48.

CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* versions from (including) 5.3.0; versions up to (excluding) 5.3.49

CVE-2026-41850

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-407 Inefficient Algorithmic Complexity

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41851

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47888

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-209 Generation of Error Message Containing Sensitive Information

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22740

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.

Older, unsupported versions are also affected.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - US_GOVERNMENT_RESOURCE
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41844

A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41845

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41846

Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47887

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22737

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41840

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.

CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41841

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-524 Use of Cache Containing Sensitive Information

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41843

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2024-38820

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

NVD-CWE-noinfo, CWE-178 Improper Handling of Case Sensitivity

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - https://security.netapp.com/advisory/ntap-20241129-0003/
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22745

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.


More precisely, an application can be vulnerable when all the following are true:

  *  the application is using Spring MVC or Spring WebFlux
  *  the application is serving static resources from the file system
  *  the application is running on a Windows platform


When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

security@vmware.com - US_GOVERNMENT_RESOURCE
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41847

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions:
Spring Framework 5.3.0 through 5.3.48.

CWE-284 Improper Access Control, NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* versions from (including) 5.3.0; versions up to (excluding) 5.3.49

CVE-2026-41852

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41853

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41839

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-384 Session Fixation

CVSSv3:

Base Score: MEDIUM (4.2)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

NVD-CWE-Other, CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv3:

Base Score: LOW (3.7)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.


More precisely, an application can be vulnerable when all the following are true:

  *  the application is using Spring MVC or Spring WebFlux
  *  the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled
  *  the application adds support for encoded resources resolution
  *  the resource cache must be empty when the attacker has access to the application


When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

CWE-524 Use of Cache Containing Sensitive Information

CVSSv3:

Base Score: LOW (3.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

security@vmware.com - US_GOVERNMENT_RESOURCE
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22735

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

CWE-667 Improper Locking

CVSSv3:

Base Score: LOW (2.6)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/spring-core/6.2.19/spring-core-6.2.19.jar
MD5: 4afe3968028c2b743dbff2d79013e144
SHA1: 691459d4644894dae8e5c2d9550a4cfb8302f62f
SHA256:52146689e71a911c92bac26677d73c692512a739893a57710cc233591756bff6
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-form-jakarta:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile
waffle-spring-security6:compile

pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	spring-core	Highest
Vendor	pom	artifactid	spring-core	Low
Vendor	pom	developer email	juergen.hoeller@broadcom.com	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Core	High
Vendor	pom	organization name	Spring IO	High
Vendor	pom	organization url	https://spring.io/projects/spring-framework	Medium
Vendor	pom	url	spring-projects/spring-framework	Highest
Product	file	name	spring-core	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	core	Highest
Product	jar	package name	io	Highest
Product	jar	package name	org	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.core	Medium
Product	Manifest	Implementation-Title	spring-core	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	spring-core	Highest
Product	pom	developer email	juergen.hoeller@broadcom.com	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Core	High
Product	pom	organization name	Spring IO	Low
Product	pom	organization url	https://spring.io/projects/spring-framework	Low
Product	pom	url	spring-projects/spring-framework	High
Version	file	version	6.2.19	High
Version	Manifest	Implementation-Version	6.2.19	High
Version	pom	version	6.2.19	Highest

Related Dependencies

spring-aop-6.2.19.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-aop/6.2.19/spring-aop-6.2.19.jar
- MD5: 36ab0f0a76202a0f8cd077fd323372a5
- SHA1: 86a538bb7b2be38a0afc4ef049784def10a86c62
- SHA256: a11b93539d80b02caf76171db2da96df39abebbfef49a2fadd6dda0779f2e20b
- pkg:maven/org.springframework/spring-aop@6.2.19
spring-beans-6.2.19.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-beans/6.2.19/spring-beans-6.2.19.jar
- MD5: ae0cf6f1e373577d322e17c350d0fb15
- SHA1: 6d6b4774db3b036df46be6332d93b09d70e5c147
- SHA256: 846dc8f30a639a36eb551ee99a30469be4d11bd285ca9daf164d98321571b404
- pkg:maven/org.springframework/spring-beans@6.2.19
spring-context-6.2.19.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-context/6.2.19/spring-context-6.2.19.jar
- MD5: 77c848b32f387021e0b690be9cd24de8
- SHA1: e218e4c4ecad1e821905628b2c4ce8561d937baa
- SHA256: ead4b645f94a7f665f00093eaafde634e97b34524294de653b51e43e0b3fc4a4
- pkg:maven/org.springframework/spring-context@6.2.19
spring-expression-6.2.19.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-expression/6.2.19/spring-expression-6.2.19.jar
- MD5: 233e2f7ced4637cad68a9449844e9a6b
- SHA1: c7202d23797fa778c5ed55e502ac1a9f0d34012a
- SHA256: d710a44417d890353895b341a722d7d08199e2b7da52f0a11c0e92571e1d6e19
- pkg:maven/org.springframework/spring-expression@6.2.19
spring-web-6.2.19.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-web/6.2.19/spring-web-6.2.19.jar
- MD5: 1d5ca2b445acea292d5787536c069a36
- SHA1: f1dc7b238611aeaf9e256a230aa089057cf0e5b3
- SHA256: ca88e364ecebee61163e2260e8a20584138eca74e28a050d6a2ef6302bad2f2d
- pkg:maven/org.springframework/spring-web@6.2.19
spring-webmvc-6.2.19.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-webmvc/6.2.19/spring-webmvc-6.2.19.jar
- MD5: df1758cf3891705ec3bb290bf75f740e
- SHA1: 836c68c8797106000e44153686b1cfa1a806a998
- SHA256: 134f42320cedd31f54f683d2ca9936a4e015c011fb1882a31fa7213e2d8c7e94
- pkg:maven/org.springframework/spring-webmvc@6.2.19

Identifiers

pkg:maven/org.springframework/spring-core@6.2.19 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:6.2.19:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:6.2.19:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:6.2.19:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-47884

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59283

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-913 Improper Control of Dynamically-Managed Code Resources

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47885

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47888

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47889

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19

CWE-1275 Sensitive Cookie with Improper SameSite Attribute

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-209 Generation of Error Message Containing Sensitive Information

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47883

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47887

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

NVD-CWE-Other, CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv3:

Base Score: LOW (3.7)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/spring-core/7.0.9/spring-core-7.0.9.jar
MD5: f87ba857b1fb00b125568d966aa66058
SHA1: e03c619fc5b26931973277f5ba65ae47967a20e3
SHA256:5195f4722699b39878d99a832549fe65df2890b159d063b88fff31b1ca65ae36
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile
waffle-spring-security7:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.core	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	spring-core	Highest
Vendor	pom	artifactid	spring-core	Low
Vendor	pom	developer email	juergen.hoeller@broadcom.com	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Core	High
Vendor	pom	organization name	Spring IO	High
Vendor	pom	organization url	https://spring.io/projects/spring-framework	Medium
Vendor	pom	url	spring-projects/spring-framework	Highest
Product	file	name	spring-core	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	core	Highest
Product	jar	package name	io	Highest
Product	jar	package name	org	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.core	Medium
Product	Manifest	Implementation-Title	spring-core	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	spring-core	Highest
Product	pom	developer email	juergen.hoeller@broadcom.com	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Core	High
Product	pom	organization name	Spring IO	Low
Product	pom	organization url	https://spring.io/projects/spring-framework	Low
Product	pom	url	spring-projects/spring-framework	High
Version	file	version	7.0.9	High
Version	Manifest	Implementation-Version	7.0.9	High
Version	pom	version	7.0.9	Highest

Related Dependencies

spring-aop-7.0.9.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-aop/7.0.9/spring-aop-7.0.9.jar
- MD5: 1766c086d944229fdca3c052bd133735
- SHA1: 35f68fd8cdf30444e18835cec152f2619c4c46c7
- SHA256: b8c5d6bfcb1f4993f2cc124f7ab7fac40edf5256b9e43c2f7250a733cb5510e9
- pkg:maven/org.springframework/spring-aop@7.0.9
spring-beans-7.0.9.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-beans/7.0.9/spring-beans-7.0.9.jar
- MD5: 4472076f5c22297927d129768a54119d
- SHA1: 2bee42fa948a5f32761fd0838de3baa1f51c0225
- SHA256: ff218b827a25c9e8929b0cd56dfb56916cea9d5b669ed97dc7cb262508ff548b
- pkg:maven/org.springframework/spring-beans@7.0.9
spring-context-7.0.9.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-context/7.0.9/spring-context-7.0.9.jar
- MD5: 4528f937c5eadd30458a0f19a977e3b8
- SHA1: 7eb8e01ecf1633ddd4d64ca184194f967b6bc0aa
- SHA256: 7552a2fcfa30cea53eb14d7a65a7a8e1b1dd82e832a7164fb7e6fb105f438858
- pkg:maven/org.springframework/spring-context@7.0.9
spring-expression-7.0.9.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-expression/7.0.9/spring-expression-7.0.9.jar
- MD5: 46931226190dcd4ab0dd8862cd7f4986
- SHA1: 9452ece85b97fa3e208046cc3a7e985c314b0034
- SHA256: 046434c40f43819729b9b1db0e6c659dfa68184c1c2c2efa5f7b3a5b27c4e2e2
- pkg:maven/org.springframework/spring-expression@7.0.9
spring-web-7.0.9.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-web/7.0.9/spring-web-7.0.9.jar
- MD5: 3ad4a5d872c4094ab34b16980aedafa9
- SHA1: c42f4ce0cded1526527296726c4ed30335dfaa10
- SHA256: 941ced476427bde2533872f293da535fd0258de3f3a650a7f1bfe01ed2927302
- pkg:maven/org.springframework/spring-web@7.0.9
spring-webmvc-7.0.9.jar
- File Path: /home/runner/.m2/repository/org/springframework/spring-webmvc/7.0.9/spring-webmvc-7.0.9.jar
- MD5: 7d4e0f02f611df75eabff8d2822b1f81
- SHA1: 53b41e6290df1a75fe0e0d16608c80a93bb63bdd
- SHA256: 8f114c1461692c5e534e82b27de23b7fb23370db8dee7ce0c92d5106906c9555
- pkg:maven/org.springframework/spring-webmvc@7.0.9

Identifiers

pkg:maven/org.springframework/spring-core@7.0.9 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:7.0.9:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:7.0.9:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:7.0.9:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Spring Security

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-core/5.8.16/spring-security-core-5.8.16.jar
MD5: c70ae997256d27ca6fb1c7a8b24e4248
SHA1: b3d21a1f967db39dabaca487ba3fe58972e6a9a5
SHA256:3be7d217048f5ea76fd6d0eddaa3169ad3bee0bba9c456e27670ec37ca33c3fd
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile
waffle-spring-security5:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter2@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	security	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.security.core	Medium
Vendor	pom	artifactid	spring-security-core	Highest
Vendor	pom	artifactid	spring-security-core	Low
Vendor	pom	developer email	info@pivotal.io	Low
Vendor	pom	developer name	Pivotal	Medium
Vendor	pom	developer org	Pivotal Software, Inc.	Medium
Vendor	pom	developer org URL	https://www.spring.io	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-core	High
Vendor	pom	organization name	Pivotal Software, Inc.	High
Vendor	pom	organization url	https://spring.io	Medium
Vendor	pom	url	https://spring.io/projects/spring-security	Highest
Product	file	name	spring-security-core	High
Product	jar	package name	core	Highest
Product	jar	package name	security	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.security.core	Medium
Product	Manifest	Implementation-Title	spring-security-core	High
Product	pom	artifactid	spring-security-core	Highest
Product	pom	developer email	info@pivotal.io	Low
Product	pom	developer name	Pivotal	Low
Product	pom	developer org	Pivotal Software, Inc.	Low
Product	pom	developer org URL	https://www.spring.io	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-core	High
Product	pom	organization name	Pivotal Software, Inc.	Low
Product	pom	organization url	https://spring.io	Low
Product	pom	url	https://spring.io/projects/spring-security	Medium
Version	file	version	5.8.16	High
Version	Manifest	Implementation-Version	5.8.16	High
Version	pom	version	5.8.16	Highest

Related Dependencies

spring-security-config-5.8.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-config/5.8.16/spring-security-config-5.8.16.jar
- MD5: 1e386c77733c252f4b9a80904ccb1c00
- SHA1: 73bff85307254de9f30514db587420110aee72ee
- SHA256: fb7218cd28ca5f82bafd4cc038d1727fc99ccfb0f3b38a8fc0545a93e9b2f8b5
- pkg:maven/org.springframework.security/spring-security-config@5.8.16
spring-security-crypto-5.8.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-crypto/5.8.16/spring-security-crypto-5.8.16.jar
- MD5: 987ca02bb810d32c7d86968ff84e887c
- SHA1: 340f3bb882bea8e9eafc66671d4c8e50f11867a7
- SHA256: e47acdd647997efb36609698b64a2bec37fa119210f88fad813aa53610433cfd
- pkg:maven/org.springframework.security/spring-security-crypto@5.8.16
spring-security-web-5.8.16.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/5.8.16/spring-security-web-5.8.16.jar
- MD5: 137862bb11c72092dd94d14d380fc784
- SHA1: fade885f7f9df056dd5e3592d949e888cd82397d
- SHA256: fe0843587f4dff188a1ecb822bf544c5f1c1ee46c757858a5a585039d8118304
- pkg:maven/org.springframework.security/spring-security-web@5.8.16

Identifiers

pkg:maven/org.springframework.security/spring-security-core@5.8.16 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:5.8.16:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:5.8.16:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-22732

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. 
This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:

: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

CWE-425 Direct Request ('Forced Browsing')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47838

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Affected versions:
Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

CWE-287 Improper Authentication

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-40988

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.

Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22748

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CWE-20 Improper Input Validation

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47842

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25

CWE-326 Inadequate Encryption Strength

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41706

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.

Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25

CWE-208 Observable Timing Discrepancy

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41003

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.

Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (5.4)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41694

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22746

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CWE-208 Observable Timing Discrepancy

CVSSv3:

Base Score: LOW (3.7)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Security

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-core/6.5.11/spring-security-core-6.5.11.jar
MD5: 697081575fdb870e6c77e4f489acb192
SHA1: d57309ff65d122a2fa45a3a8f47b01e9183cb6e6
SHA256:26ac26527cc015c5c71f3832add705a2410129a8f8de847054f2bc3b1d2e4465
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-form-jakarta:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-starter3:compile
waffle-spring-security6:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter3@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	security	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.security.core	Medium
Vendor	pom	artifactid	spring-security-core	Highest
Vendor	pom	artifactid	spring-security-core	Low
Vendor	pom	developer email	info@pivotal.io	Low
Vendor	pom	developer name	Pivotal	Medium
Vendor	pom	developer org	Pivotal Software, Inc.	Medium
Vendor	pom	developer org URL	https://www.spring.io	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-core	High
Vendor	pom	organization name	Pivotal Software, Inc.	High
Vendor	pom	organization url	https://spring.io	Medium
Vendor	pom	url	https://spring.io/projects/spring-security	Highest
Product	file	name	spring-security-core	High
Product	jar	package name	core	Highest
Product	jar	package name	security	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.security.core	Medium
Product	Manifest	Implementation-Title	spring-security-core	High
Product	pom	artifactid	spring-security-core	Highest
Product	pom	developer email	info@pivotal.io	Low
Product	pom	developer name	Pivotal	Low
Product	pom	developer org	Pivotal Software, Inc.	Low
Product	pom	developer org URL	https://www.spring.io	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-core	High
Product	pom	organization name	Pivotal Software, Inc.	Low
Product	pom	organization url	https://spring.io	Low
Product	pom	url	https://spring.io/projects/spring-security	Medium
Version	file	version	6.5.11	High
Version	Manifest	Implementation-Version	6.5.11	High
Version	pom	version	6.5.11	Highest

Related Dependencies

spring-security-config-6.5.11.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-config/6.5.11/spring-security-config-6.5.11.jar
- MD5: 56a1f736ee4e6e8557ea360d0ae995c3
- SHA1: c698bc32f1f10f85b3ade54575077eaebc9b86c3
- SHA256: 218685930013a2d1c126a896490ac3c44cf6fe90cf3d0286f2266bb877f916f7
- pkg:maven/org.springframework.security/spring-security-config@6.5.11
spring-security-crypto-6.5.11.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-crypto/6.5.11/spring-security-crypto-6.5.11.jar
- MD5: d9fb7f74b14c2c049d46d0454f138247
- SHA1: 2cbc07fa7650ef2f49bcc5ac35e7666c79614f55
- SHA256: dcdd2f3b2d5d2bb1531986b5cc1737b464a76d8b5831f93fc8da9cdd67e6797f
- pkg:maven/org.springframework.security/spring-security-crypto@6.5.11
spring-security-web-6.5.11.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/6.5.11/spring-security-web-6.5.11.jar
- MD5: 9e6b94f61b08fe8d113a7835bb994576
- SHA1: eeee13020ef81f290633e68fe062bccba062774e
- SHA256: 50df9fc76162d33cf8b5410cf7a7a969abd42a5ecddb284aab4f453cb5512306
- pkg:maven/org.springframework.security/spring-security-web@6.5.11

Identifiers

pkg:maven/org.springframework.security/spring-security-core@6.5.11 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:6.5.11:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:6.5.11:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47841

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: HIGH (7.4)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47842

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25

CWE-326 Inadequate Encryption Strength

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25

CWE-208 Observable Timing Discrepancy

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Security

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-core/7.1.1/spring-security-core-7.1.1.jar
MD5: e9c072aeb1ab83fb92dd5a0bc556a857
SHA1: c0373b564151af7a3001ccfbea589bf37dd6dc3b
SHA256:98a5011baa78df36fb184e6ce0e8e086ca9a64fcdd8f161c0a96475a3a0907bd
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter4:compile
waffle-spring-security7:compile

pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT
pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	security	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.security.core	Medium
Vendor	pom	artifactid	spring-security-core	Highest
Vendor	pom	artifactid	spring-security-core	Low
Vendor	pom	developer email	info@pivotal.io	Low
Vendor	pom	developer name	Pivotal	Medium
Vendor	pom	developer org	Pivotal Software, Inc.	Medium
Vendor	pom	developer org URL	https://www.spring.io	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-core	High
Vendor	pom	organization name	Pivotal Software, Inc.	High
Vendor	pom	organization url	https://spring.io	Medium
Vendor	pom	url	https://spring.io/projects/spring-security	Highest
Product	file	name	spring-security-core	High
Product	jar	package name	core	Highest
Product	jar	package name	security	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	automatic-module-name	spring.security.core	Medium
Product	Manifest	Implementation-Title	spring-security-core	High
Product	pom	artifactid	spring-security-core	Highest
Product	pom	developer email	info@pivotal.io	Low
Product	pom	developer name	Pivotal	Low
Product	pom	developer org	Pivotal Software, Inc.	Low
Product	pom	developer org URL	https://www.spring.io	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-core	High
Product	pom	organization name	Pivotal Software, Inc.	Low
Product	pom	organization url	https://spring.io	Low
Product	pom	url	https://spring.io/projects/spring-security	Medium
Version	file	version	7.1.1	High
Version	Manifest	Implementation-Version	7.1.1	High
Version	pom	version	7.1.1	Highest

Related Dependencies

spring-security-config-7.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-config/7.1.1/spring-security-config-7.1.1.jar
- MD5: 08ebfc196ab56b26cd5d36ebb5497f70
- SHA1: 06aadefb4acc552578b28f0b95908158861bea08
- SHA256: 1f947c853f14cab76563464ee22e72f6672f3913db52647d2f5d1df5f2b1e5a5
- pkg:maven/org.springframework.security/spring-security-config@7.1.1
spring-security-crypto-7.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-crypto/7.1.1/spring-security-crypto-7.1.1.jar
- MD5: cd2777efdf4d91dd0b264f608af574ef
- SHA1: 5356e8056e4dcb18b12550c422fb12e0c8e742ae
- SHA256: 6e8bb2337faccabd30626f917ed1d2bfa9dde982229b6b373b644d1a01635403
- pkg:maven/org.springframework.security/spring-security-crypto@7.1.1
spring-security-web-7.1.1.jar
- File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/7.1.1/spring-security-web-7.1.1.jar
- MD5: cc76d1f39558ef5eeaee80997caac280
- SHA1: 449685cf2be4029b1200f1d0860a15caa5c2d05b
- SHA256: dece134a2332c976a2c94ecf13f816c64e8ea7f2139795485afe655fba0408f3
- pkg:maven/org.springframework.security/spring-security-web@7.1.1

Identifiers

pkg:maven/org.springframework.security/spring-security-core@7.1.1 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:7.1.1:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:7.1.1:*:*:*:*:*:*:* (Confidence:Highest)

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/6.5.11/spring-security-web-6.5.11.jar/org/springframework/security/spring-security-webauthn.js
MD5: d8d90d854a23d021c2e758b3eebce213
SHA1: 7814ccd3adc2388f52b2658bf5fc30b457949ab6
SHA256:044a2b8d7e995bff815565678631a2d3a5cc0aa96ef8ac35cfacb579307f77a9
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-demo-spring-boot-filter4:compile
waffle-demo-spring-filter-jakarta:compile
waffle-demo-spring-form-jakarta:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile
waffle-spring-boot-autoconfigure4:compile
waffle-spring-boot-starter3:compile
waffle-spring-boot-starter4:compile
waffle-spring-security6:compile
waffle-spring-security7:compile

Evidence

Related Dependencies

Identifiers

None

Description:

Spring Web

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/runner/.m2/repository/org/springframework/spring-web/5.3.39/spring-web-5.3.39.jar
MD5: 2b940bc714d6e29570b5dfa92755eefc
SHA1: 4ab03cd7376a6b3365d2798aac8d01dcd22c0174
SHA256:444f243b936119b5488029f2d9399a3980855c60b493b9e2811464c6433a2b71
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-demo-spring-filter:compile
waffle-demo-spring-form:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile
waffle-spring-boot-starter2:compile
waffle-spring-security5:compile

pkg:maven/com.github.waffle/waffle-spring-security5@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-web	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	web	Highest
Vendor	Manifest	automatic-module-name	spring.web	Medium
Vendor	pom	artifactid	spring-web	Highest
Vendor	pom	artifactid	spring-web	Low
Vendor	pom	developer email	jhoeller@pivotal.io	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Web	High
Vendor	pom	organization name	Spring IO	High
Vendor	pom	organization url	https://spring.io/projects/spring-framework	Medium
Vendor	pom	url	spring-projects/spring-framework	Highest
Product	file	name	spring-web	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	springframework	Highest
Product	jar	package name	web	Highest
Product	Manifest	automatic-module-name	spring.web	Medium
Product	Manifest	Implementation-Title	spring-web	High
Product	pom	artifactid	spring-web	Highest
Product	pom	developer email	jhoeller@pivotal.io	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Web	High
Product	pom	organization name	Spring IO	Low
Product	pom	organization url	https://spring.io/projects/spring-framework	Low
Product	pom	url	spring-projects/spring-framework	High
Version	file	version	5.3.39	High
Version	Manifest	Implementation-Version	5.3.39	High
Version	pom	version	5.3.39	Highest

Identifiers

pkg:maven/org.springframework/spring-web@5.3.39 (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:5.3.39:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:5.3.39:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:5.3.39:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2016-1000027

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

CWE-502 Deserialization of Untrusted Data

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - https://security.netapp.com/advisory/ntap-20230420-0009/
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
cve@mitre.org - https://security.netapp.com/advisory/ntap-20230420-0009/
cve@mitre.org - BROKEN_LINK,EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - RELEASE_NOTES,THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.0

CVE-2026-41855

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-502 Deserialization of Untrusted Data

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47884

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59283

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-913 Improper Control of Dynamically-Managed Code Resources

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41842

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41848

Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-1333 Inefficient Regular Expression Complexity

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41849

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).

Affected versions:
Spring Framework 5.3.0 through 5.3.48.

CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* versions from (including) 5.3.0; versions up to (excluding) 5.3.49

CVE-2026-41850

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-407 Inefficient Algorithmic Complexity

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41851

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47888

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-209 Generation of Error Message Containing Sensitive Information

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22740

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.

Older, unsupported versions are also affected.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - US_GOVERNMENT_RESOURCE
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41844

A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41845

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41846

Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-47887

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22737

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41840

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.

CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41841

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-524 Use of Cache Containing Sensitive Information

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41843

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2024-38820

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

NVD-CWE-noinfo, CWE-178 Improper Handling of Case Sensitivity

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - https://security.netapp.com/advisory/ntap-20241129-0003/
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22745

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.


More precisely, an application can be vulnerable when all the following are true:

  *  the application is using Spring MVC or Spring WebFlux
  *  the application is serving static resources from the file system
  *  the application is running on a Windows platform


When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

security@vmware.com - US_GOVERNMENT_RESOURCE
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41847

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions:
Spring Framework 5.3.0 through 5.3.48.

CWE-284 Improper Access Control, NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* versions from (including) 5.3.0; versions up to (excluding) 5.3.49

CVE-2026-41852

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41853

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-41839

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CWE-384 Session Fixation

CVSSv3:

Base Score: MEDIUM (4.2)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

NVD-CWE-Other, CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv3:

Base Score: LOW (3.7)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.


More precisely, an application can be vulnerable when all the following are true:

  *  the application is using Spring MVC or Spring WebFlux
  *  the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled
  *  the application adds support for encoded resources resolution
  *  the resource cache must be empty when the attacker has access to the application


When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

CWE-524 Use of Cache Containing Sensitive Information

CVSSv3:

Base Score: LOW (3.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

security@vmware.com - US_GOVERNMENT_RESOURCE
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-22735

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

CWE-667 Improper Locking

CVSSv3:

Base Score: LOW (2.6)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Annotations Package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-annotations-api/10.1.59/tomcat-annotations-api-10.1.59.jar
MD5: 1511cb00e4f23ef59e754d32bace7f2d
SHA1: 67328cdf84b6ae3e2f40a68efa3003b3e2933a91
SHA256:72d62f984796d11acece18e01c541252b4e9fd6ccdb559816c7dfda49587d540
Referenced In Project/Scope: waffle-tomcat10:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-annotations-api	High
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAnnotations;version:Version="2.1";uses:="jakarta.annotation,jakarta.annotation.security,jakarta.annotation.sql"	Low
Vendor	manifest: jakarta/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-annotations-api	Highest
Vendor	pom	artifactid	tomcat-annotations-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	jakarta	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAnnotations;version:Version="2.1";uses:="jakarta.annotation,jakarta.annotation.security,jakarta.annotation.sql"	Low
Product	manifest: jakarta/annotation/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/annotation/	Specification-Title	Jakarta Annotations	Medium
Product	manifest: jakarta/annotation/security/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/annotation/security/	Specification-Title	Jakarta Annotations	Medium
Product	manifest: jakarta/annotation/sql/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/annotation/sql/	Specification-Title	Jakarta Annotations	Medium
Product	pom	artifactid	tomcat-annotations-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.59	High
Version	Manifest	Bundle-Version	10.1.59	High
Version	pom	version	10.1.59	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.59 (Confidence:High)
cpe:2.3:a:www-sql_project:www-sql:10.1.59:*:*:*:*:*:*:* (Confidence:Low)

Description:

Annotations Package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-annotations-api/11.0.25/tomcat-annotations-api-11.0.25.jar
MD5: 1442a199e016df4bc2093f275dd2b489
SHA1: 6ff6cac3ee4daf6b7c76adbeed0f2f7a37f7cb9b
SHA256:d32cc2aad115b27456ce075b2167b3d549aa9ca75439d67f6a60bcc057d7212d
Referenced In Project/Scope: waffle-tomcat11:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-annotations-api	High
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAnnotations;version:Version="3.0";uses:="jakarta.annotation,jakarta.annotation.security,jakarta.annotation.sql"	Low
Vendor	manifest: jakarta/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-annotations-api	Highest
Vendor	pom	artifactid	tomcat-annotations-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	jakarta	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAnnotations;version:Version="3.0";uses:="jakarta.annotation,jakarta.annotation.security,jakarta.annotation.sql"	Low
Product	manifest: jakarta/annotation/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/annotation/	Specification-Title	Jakarta Annotations	Medium
Product	manifest: jakarta/annotation/security/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/annotation/security/	Specification-Title	Jakarta Annotations	Medium
Product	manifest: jakarta/annotation/sql/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/annotation/sql/	Specification-Title	Jakarta Annotations	Medium
Product	pom	artifactid	tomcat-annotations-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.25	High
Version	Manifest	Bundle-Version	11.0.25	High
Version	pom	version	11.0.25	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-annotations-api@11.0.25 (Confidence:High)
cpe:2.3:a:www-sql_project:www-sql:11.0.25:*:*:*:*:*:*:* (Confidence:Low)

Description:

Annotations Package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-annotations-api/9.0.121/tomcat-annotations-api-9.0.121.jar
MD5: eacf11ea4e72b9f27f2eafc415d0341b
SHA1: 5281544382512e6cbc6af72ca3f6812f02876138
SHA256:868d6956d44f5933574ec44efdfb1110c975a96720b5dae0f3b8cd60cce9c5c8
Referenced In Project/Scope: waffle-tomcat9:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.121

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-annotations-api	High
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-annotations-api	Highest
Vendor	pom	artifactid	tomcat-annotations-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/security/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/security/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/sql/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/sql/	Specification-Title	Common Annotations	Medium
Product	pom	artifactid	tomcat-annotations-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-annotations-api@9.0.121 (Confidence:High)
cpe:2.3:a:www-sql_project:www-sql:9.0.121:*:*:*:*:*:*:* (Confidence:Low)

Description:

Definition of interfaces shared by Catalina and Jasper

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-api/10.1.59/tomcat-api-10.1.59.jar
MD5: 35b43c0abdef153ebccdbdd6f6f1f000
SHA1: 30bc2d71e5d16c41aaa2a36cf40894ff82aae2d4
SHA256:50f25e55ed8b2cd873a2fd0deca75f6adf6d396c9195270fefcc1763244f91ea
Referenced In Project/Scope: waffle-tomcat10:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-api	Highest
Vendor	pom	artifactid	tomcat-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.59	High
Version	Manifest	Bundle-Version	10.1.59	High
Version	Manifest	Implementation-Version	10.1.59	High
Version	pom	version	10.1.59	Highest

Related Dependencies

tomcat-catalina-10.1.59.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-catalina/10.1.59/tomcat-catalina-10.1.59.jar
- MD5: 953dca752b35cb44185d34469f70dad6
- SHA1: ab0996d22707d45f190d82fb0cbfae06067afa4f
- SHA256: b616671ea5b2a383f65357131feb52955fb8a7e3a0b7af1a2e0e9dbec5094df1
- pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59
tomcat-coyote-10.1.59.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-coyote/10.1.59/tomcat-coyote-10.1.59.jar
- MD5: be90aa2a81b78e32113e3d2e78616953
- SHA1: fcde4b4c9d88c512cc01e13709cc596f32f5d1f1
- SHA256: f70cf94120bb9385eb37069dbaa541aabd9256221e2115ef19d5237b08a66869
- pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.59
tomcat-jaspic-api-10.1.59.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jaspic-api/10.1.59/tomcat-jaspic-api-10.1.59.jar
- MD5: e035f4e9a37a675a5f182bc62ebb96bf
- SHA1: 225647dd003eeb71cf04a5a78ef7d898a8a6c50d
- SHA256: 5564a4e4426b8d1316193c2206afc482e4e0246012e6ecd17ebabe7448fbd1f5
- pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.59
tomcat-jsp-api-10.1.59.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jsp-api/10.1.59/tomcat-jsp-api-10.1.59.jar
- MD5: 3db1bb27ade87c87722b3b2037afc008
- SHA1: c4d8dd60480a7285b8c072cc5c96ff8b986202aa
- SHA256: add832a458c16a0a35876ac606518bc5b011d3ef631c6b8b5e92abd0dd05edc7
- pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.59
tomcat-util-10.1.59.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-util/10.1.59/tomcat-util-10.1.59.jar
- MD5: 43f09711bdc7b9f70ef6ac498621058c
- SHA1: 007937e7c0d42af082432dc143b225a60a5f4d64
- SHA256: f27c2c640ebe5533afc4f1d204d5f00b7ce4d0778b489dbee8be069be3a98508
- pkg:maven/org.apache.tomcat/tomcat-util@10.1.59
tomcat-util-scan-10.1.59.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-util-scan/10.1.59/tomcat-util-scan-10.1.59.jar
- MD5: 8b3474f8afa5077f007e9af59fbb6224
- SHA1: bcb2d97eafd885c8e36e093019057fd8565fd360
- SHA256: 3546da91654255dfb49577ec4e5c792156f6cbd70f472315f3c40168d6c38989
- pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.59

Identifiers

pkg:maven/org.apache.tomcat/tomcat-api@10.1.59 (Confidence:High)
cpe:2.3:a:apache:tomcat:10.1.59:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:10.1.59:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Definition of interfaces shared by Catalina and Jasper

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-api/11.0.25/tomcat-api-11.0.25.jar
MD5: e7d606ee31ab4459c3368aae585d9d5f
SHA1: 6813be21f2f14d6fa5df836c4e20a8506782f452
SHA256:b409c9b629d3990a8cc06080c3704d91bf994e18c2d82bc376e2bb4653d990a8
Referenced In Project/Scope: waffle-tomcat11:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-api	Highest
Vendor	pom	artifactid	tomcat-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.25	High
Version	Manifest	Bundle-Version	11.0.25	High
Version	Manifest	Implementation-Version	11.0.25	High
Version	pom	version	11.0.25	Highest

Related Dependencies

tomcat-catalina-11.0.25.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-catalina/11.0.25/tomcat-catalina-11.0.25.jar
- MD5: e92ba58f47cf3c3d33ee3e2257f21869
- SHA1: 363c952d6cdc1eb5a13418308c7ce4a0ace9b754
- SHA256: 307cf60942e29b889ff3f8b56c63d5290a8182f43b5279ec53f091b08859ba64
- pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25
tomcat-coyote-11.0.25.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-coyote/11.0.25/tomcat-coyote-11.0.25.jar
- MD5: a8df06c35494769244a1dbae532f722b
- SHA1: b973f78b4ef6ffd2048fa8ab05fe0a91796c7e83
- SHA256: 1b29ff8987b92685a451ccc708faf896a7ff811313e114c1e80756b95aef97d8
- pkg:maven/org.apache.tomcat/tomcat-coyote@11.0.25
tomcat-jaspic-api-11.0.25.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jaspic-api/11.0.25/tomcat-jaspic-api-11.0.25.jar
- MD5: 7bc797da4f8dc5de1dc3e5c2777d25c8
- SHA1: b9e262629f1739c848b2392776d1952a65c53ae6
- SHA256: 1bc68e301e5397ea48fc34df0df9959831bcd13ed6e4dd18893cc5d921902ea8
- pkg:maven/org.apache.tomcat/tomcat-jaspic-api@11.0.25
tomcat-jsp-api-11.0.25.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jsp-api/11.0.25/tomcat-jsp-api-11.0.25.jar
- MD5: 6a457b35d84089ae3f5acff0b3681561
- SHA1: d7cd1d8c053614e364445dcab86b3b319620c3b4
- SHA256: 5d8c40fd4dbc9704cb44652375a16c03d306ab15335f4bae456b76008d8e7d17
- pkg:maven/org.apache.tomcat/tomcat-jsp-api@11.0.25
tomcat-util-11.0.25.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-util/11.0.25/tomcat-util-11.0.25.jar
- MD5: 124d3ebebdddbba7b8e31bb83df1329d
- SHA1: 9f56b762a18498dc4b680c02a1ebf809e9573c2f
- SHA256: cd94cec0293418424430408a44964013507b4bb42674ebffee203921355311d1
- pkg:maven/org.apache.tomcat/tomcat-util@11.0.25
tomcat-util-scan-11.0.25.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-util-scan/11.0.25/tomcat-util-scan-11.0.25.jar
- MD5: de0e04874216cc939e0b97881ce7f220
- SHA1: 53a3fc253babb28852b7434887cab2267a164bd2
- SHA256: 6194a29b82abfa1f06a813d93035bd0539be31f98586def574624acea481a115
- pkg:maven/org.apache.tomcat/tomcat-util-scan@11.0.25

Identifiers

pkg:maven/org.apache.tomcat/tomcat-api@11.0.25 (Confidence:High)
cpe:2.3:a:apache:tomcat:11.0.25:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:11.0.25:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Expression language package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-el-api/10.1.59/tomcat-el-api-10.1.59.jar
MD5: 3afda78f7d6768e16ea9202871cd6047
SHA1: 5fdaddc589618805c366538802e472982da81968
SHA256:39ccbf14437739e8e6ac831ba7fc774603a98fb6f1545f98bc352d1b6c706d21
Referenced In Project/Scope: waffle-tomcat10:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	expression	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="5.0";uses:="jakarta.el"	Low
Vendor	manifest: jakarta/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-el-api	Highest
Vendor	pom	artifactid	tomcat-el-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="5.0";uses:="jakarta.el"	Low
Product	manifest: jakarta/el/	Implementation-Title	jakarta.el	Medium
Product	manifest: jakarta/el/	Specification-Title	Jakarta Expression Language	Medium
Product	pom	artifactid	tomcat-el-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.59	High
Version	Manifest	Bundle-Version	10.1.59	High
Version	pom	version	10.1.59	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.59 (Confidence:High)

Description:

Expression language package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-el-api/11.0.25/tomcat-el-api-11.0.25.jar
MD5: 1128aa2b95e6c6ca0b0cdaadb355dece
SHA1: 98b52c8d938d176f339743401866923cb715a0f4
SHA256:3873433d1f43e0b8ab1582b839a2b285c47897df23a80b06d7207f41aa902e47
Referenced In Project/Scope: waffle-tomcat11:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	expression	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="6.0";uses:="jakarta.el"	Low
Vendor	manifest: jakarta/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-el-api	Highest
Vendor	pom	artifactid	tomcat-el-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="6.0";uses:="jakarta.el"	Low
Product	manifest: jakarta/el/	Implementation-Title	jakarta.el	Medium
Product	manifest: jakarta/el/	Specification-Title	Jakarta Expression Language	Medium
Product	pom	artifactid	tomcat-el-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.25	High
Version	Manifest	Bundle-Version	11.0.25	High
Version	pom	version	11.0.25	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-el-api@11.0.25 (Confidence:High)

Description:

Expression language package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-el-api/9.0.121/tomcat-el-api-9.0.121.jar
MD5: ee0d945df532fa5148d2de0ee958788d
SHA1: 0c2f022fecc3de1cfb5513dc9dc3cabe64793407
SHA256:0180bffba911192f08b5f64d18aeba90df16343271215c967c38fde9225cd01d
Referenced In Project/Scope: waffle-tomcat9:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.121

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	expression	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-el-api	Highest
Vendor	pom	artifactid	tomcat-el-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Product	pom	artifactid	tomcat-el-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.121 (Confidence:High)

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/10.1.55/tomcat-embed-core-10.1.55.jar
MD5: b56211060ef226699d7c6746444c94e9
SHA1: 740c1000c60766b3a4d99903434fd1a1d67ec229
SHA256:82473f841824095e03f2c938c18707e44e388e34fb1735b2b338bb4f22fd54f0
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-embed-core	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-embed-core	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAuthentication;version:Version="3.0";uses:="jakarta.security.auth.message,jakarta.security.auth.message.callback,jakarta.security.auth.message.config,jakarta.security.auth.message.module",osgi.contract;osgi.contract=JakartaServlet;version:Version="6.0";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	manifest: jakarta/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-embed-core	Highest
Vendor	pom	artifactid	tomcat-embed-core	Low
Vendor	pom	groupid	org.apache.tomcat.embed	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-embed-core	High
Product	jar	package name	annotation	Highest
Product	jar	package name	apache	Highest
Product	jar	package name	auth	Highest
Product	jar	package name	core	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	jakarta	Highest
Product	jar	package name	message	Highest
Product	jar	package name	security	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-embed-core	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-embed-core	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAuthentication;version:Version="3.0";uses:="jakarta.security.auth.message,jakarta.security.auth.message.callback,jakarta.security.auth.message.config,jakarta.security.auth.message.module",osgi.contract;osgi.contract=JakartaServlet;version:Version="6.0";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	manifest: jakarta/security/auth/message/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/security/auth/message/callback/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/callback/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/security/auth/message/config/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/config/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/security/auth/message/module/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/module/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/servlet/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/http/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/http/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/resources/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/resources/	Specification-Title	Jakarta Servlet	Medium
Product	pom	artifactid	tomcat-embed-core	Highest
Product	pom	groupid	org.apache.tomcat.embed	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.55	High
Version	Manifest	Bundle-Version	10.1.55	High
Version	Manifest	Implementation-Version	10.1.55	High
Version	pom	version	10.1.55	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55 (Confidence:High)
cpe:2.3:a:apache:tomcat:10.1.55:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:10.1.55:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-20 Improper Input Validation

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65905

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST 
authenticated request with a nonceCount on the upper boundary of the 
replay window then that request is replayable once only while the 
associated nonceCount remains within the replay window.



 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-294 Authentication Bypass by Capture-replay

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-53434

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

CWE-390 Detection of Error Condition Without Action

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-55276

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

CWE-670 Always-Incorrect Control Flow Implementation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59083

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

CWE-177 Improper Handling of URL Encoding (Hex Encoding)

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

CWE-1059 Insufficient Technical Documentation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CWE-863 Incorrect Authorization, CWE-284 Improper Access Control

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-68525

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.















Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65183

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-66422

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-285 Improper Authorization

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-68569

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.







Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-287 Improper Authentication

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65927

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

CWE-193 Off-by-one Error

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-68763

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-53404

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CWE-670 Always-Incorrect Control Flow Implementation

CVSSv3:

Base Score: HIGH (7.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-613 Insufficient Session Expiration

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-55955

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

CWE-287 Improper Authentication

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-55956

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CWE-285 Improper Authorization

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-50229

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv3:

Base Score: MEDIUM (6.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/11.0.24/tomcat-embed-core-11.0.24.jar
MD5: 87410cbfa90c782419859efb70e1fd91
SHA1: 0172bb449cba1a8ffcffa249727907602a4cc899
SHA256:e7b966dcaac8c5ffa4f10e44031ebf5b71f2123560c08ac8b7120028615aea08
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-embed-core	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-embed-core	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAuthentication;version:Version="3.1";uses:="jakarta.security.auth.message,jakarta.security.auth.message.callback,jakarta.security.auth.message.config,jakarta.security.auth.message.module",osgi.contract;osgi.contract=JakartaServlet;version:Version="6.1";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	manifest: jakarta/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-embed-core	Highest
Vendor	pom	artifactid	tomcat-embed-core	Low
Vendor	pom	groupid	org.apache.tomcat.embed	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-embed-core	High
Product	jar	package name	annotation	Highest
Product	jar	package name	apache	Highest
Product	jar	package name	auth	Highest
Product	jar	package name	core	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	jakarta	Highest
Product	jar	package name	message	Highest
Product	jar	package name	security	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-embed-core	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-embed-core	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaAuthentication;version:Version="3.1";uses:="jakarta.security.auth.message,jakarta.security.auth.message.callback,jakarta.security.auth.message.config,jakarta.security.auth.message.module",osgi.contract;osgi.contract=JakartaServlet;version:Version="6.1";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	manifest: jakarta/security/auth/message/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/security/auth/message/callback/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/callback/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/security/auth/message/config/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/config/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/security/auth/message/module/	Implementation-Title	jakarta.security.auth.message	Medium
Product	manifest: jakarta/security/auth/message/module/	Specification-Title	Jakarta Authentication SPI for Containers	Medium
Product	manifest: jakarta/servlet/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/http/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/http/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/resources/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/resources/	Specification-Title	Jakarta Servlet	Medium
Product	pom	artifactid	tomcat-embed-core	Highest
Product	pom	groupid	org.apache.tomcat.embed	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.24	High
Version	Manifest	Bundle-Version	11.0.24	High
Version	Manifest	Implementation-Version	11.0.24	High
Version	pom	version	11.0.24	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.24 (Confidence:High)
cpe:2.3:a:apache:tomcat:11.0.24:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:11.0.24:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-20 Improper Input Validation

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65905

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST 
authenticated request with a nonceCount on the upper boundary of the 
replay window then that request is replayable once only while the 
associated nonceCount remains within the replay window.



 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-294 Authentication Bypass by Capture-replay

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CWE-863 Incorrect Authorization, CWE-284 Improper Access Control

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-68525

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.















Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.

CWE-863 Incorrect Authorization

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65183

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-66422

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-285 Improper Authorization

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-68569

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.







Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-287 Improper Authentication

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-65927

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

CWE-193 Off-by-one Error

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-68763

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CWE-613 Insufficient Session Expiration

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.121/tomcat-embed-core-9.0.121.jar
MD5: 5415a28d9480e99358be13a8e67f10e4
SHA1: f5b12a41e11085d2576155343a7a4af4e5ab3f78
SHA256:abd8674e1472f2f3e5769d3f1de46c3d4f63a38f323b21ed8d34531b9bf305f6
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-embed-core	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-embed-core	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module",osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	manifest: javax/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-embed-core	Highest
Vendor	pom	artifactid	tomcat-embed-core	Low
Vendor	pom	groupid	org.apache.tomcat.embed	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-embed-core	High
Product	jar	package name	annotation	Highest
Product	jar	package name	apache	Highest
Product	jar	package name	auth	Highest
Product	jar	package name	core	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	java	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	message	Highest
Product	jar	package name	security	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	servlets	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-embed-core	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-embed-core	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module",osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	manifest: javax/security/auth/message/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/callback/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/callback/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/config/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/config/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/module/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/module/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Product	pom	artifactid	tomcat-embed-core	Highest
Product	pom	groupid	org.apache.tomcat.embed	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	Manifest	Implementation-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Related Dependencies

tomcat-api-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-api/9.0.121/tomcat-api-9.0.121.jar
- MD5: ad25867f1de38499521141fad581fae1
- SHA1: e0ddb6bb5ad2296e932e2b8a77a23198761e8b63
- SHA256: 9b6c53068a14a717bd8f8ca7e4999dc00a681430d2611ca8fda22625d4618bf8
- pkg:maven/org.apache.tomcat/tomcat-api@9.0.121
tomcat-catalina-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-catalina/9.0.121/tomcat-catalina-9.0.121.jar
- MD5: 7e44c46dfed62d9d4d431f8c470d9ae0
- SHA1: 36055212f7e88d02b196cf6d458e3aa52ae713ab
- SHA256: 995751fd05dc757506945c7b5f0e56c37a32474d786bea0994a366252fac4fd0
- pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.121
tomcat-coyote-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-coyote/9.0.121/tomcat-coyote-9.0.121.jar
- MD5: 37c8afd3afdc0fc35c352052417e4939
- SHA1: 8de328823eeeae6bdaf6e0b46a59e9e81e44af1b
- SHA256: 0e18cc0a571e6efa16ee2a4e915b8daac68be6e90f5b03e72eb70d71af02a2d1
- pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.121
tomcat-embed-websocket-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-websocket/9.0.121/tomcat-embed-websocket-9.0.121.jar
- MD5: b0e72e7c3d23c5bf0f16eddb644ecd1b
- SHA1: ec61eeb151a645216661d54347cde514b00c70b5
- SHA256: f327cfe666ea07ca12e6fd3bd8dd5080689357915e3ba9e3023ad5ccb371c223
- pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.121
tomcat-jaspic-api-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jaspic-api/9.0.121/tomcat-jaspic-api-9.0.121.jar
- MD5: 7627836c6193b4ba0f2da63405574ced
- SHA1: 0e0f8bb93937b66f21b3e90a05c2942f71da8dd5
- SHA256: 39d46568b167a4d021bce1afda8d1872db03e9f56ddce2114c589b82af44cac8
- pkg:maven/org.apache.tomcat/tomcat-jaspic-api@9.0.121
tomcat-jsp-api-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jsp-api/9.0.121/tomcat-jsp-api-9.0.121.jar
- MD5: 253a510203be25e7010b123a00b02608
- SHA1: cc7af41e6267bb222aff60f9bba2fb0863230696
- SHA256: c218d37ac99ce503cab69c000bf7a8eddb08a4845a2bca921e618dcf1e61e05f
- pkg:maven/org.apache.tomcat/tomcat-jsp-api@9.0.121
tomcat-util-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-util/9.0.121/tomcat-util-9.0.121.jar
- MD5: b1c3e1a2d56586ef48805e277cf41260
- SHA1: 311e741fe53557fcd7afb5b74379afe27e6846ca
- SHA256: f17760b44c29dc368874c59ab1c6dcd047d8e577aa5b87dbe74a36e8a0280dc5
- pkg:maven/org.apache.tomcat/tomcat-util@9.0.121
tomcat-util-scan-9.0.121.jar
- File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-util-scan/9.0.121/tomcat-util-scan-9.0.121.jar
- MD5: 89ad139f49c57853763020c84429cc4b
- SHA1: 94ec50c8e413258134cbb6394be5156a3a692f14
- SHA256: 4027e44942c7acfeb24119d59f34980e7f56d341bb2ea54cd635d3d6cd256015
- pkg:maven/org.apache.tomcat/tomcat-util-scan@9.0.121

Identifiers

pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.121 (Confidence:High)
cpe:2.3:a:apache:tomcat:9.0.121:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.121:*:*:*:*:*:*:* (Confidence:Highest)

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-el/10.1.55/tomcat-embed-el-10.1.55.jar
MD5: 3aa05b1e98fe6122d642e890db5f599c
SHA1: 202f2de13bd61be720cf302f28d63eda558d29f3
SHA256:a527fe51c6f9428c5116f78fe28588e55357b4492309b51fb0453372da16fa5f
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter3:compile
waffle-distro-jakarta:runtime
waffle-spring-boot-autoconfigure3:compile

pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter3@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-embed-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	el	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-embed-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="5.0";uses:="jakarta.el",osgi.service;objectClass:List="jakarta.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="jakarta.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	manifest: jakarta/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-embed-el	Highest
Vendor	pom	artifactid	tomcat-embed-el	Low
Vendor	pom	groupid	org.apache.tomcat.embed	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-embed-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	expressionfactory	Highest
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	Bundle-Name	tomcat-embed-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-embed-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="5.0";uses:="jakarta.el",osgi.service;objectClass:List="jakarta.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="jakarta.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	manifest: jakarta/el/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/el/	Specification-Title	Jakarta Expression Language	Medium
Product	pom	artifactid	tomcat-embed-el	Highest
Product	pom	groupid	org.apache.tomcat.embed	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.55	High
Version	Manifest	Bundle-Version	10.1.55	High
Version	Manifest	Implementation-Version	10.1.55	High
Version	pom	version	10.1.55	Highest

Identifiers

pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@10.1.55 (Confidence:High)

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-el/11.0.24/tomcat-embed-el-11.0.24.jar
MD5: cb6b040782afb670264116a994b0bcae
SHA1: 3eafa072a45e67081452e56576ab4fe68b525fb5
SHA256:ad0546f12dace008aacce18ba13222137760b310ca719e173d3e13021b9af6c6
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter4:compile
waffle-spring-boot-autoconfigure4:compile

pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-embed-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	el	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-embed-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="6.0";uses:="jakarta.el",osgi.service;objectClass:List="jakarta.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="jakarta.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	manifest: jakarta/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-embed-el	Highest
Vendor	pom	artifactid	tomcat-embed-el	Low
Vendor	pom	groupid	org.apache.tomcat.embed	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-embed-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	expressionfactory	Highest
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	jakarta	Highest
Product	Manifest	Bundle-Name	tomcat-embed-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-embed-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaExpressionLanguage;version:Version="6.0";uses:="jakarta.el",osgi.service;objectClass:List="jakarta.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="jakarta.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	manifest: jakarta/el/	Implementation-Title	jakarta.annotation	Medium
Product	manifest: jakarta/el/	Specification-Title	Jakarta Expression Language	Medium
Product	pom	artifactid	tomcat-embed-el	Highest
Product	pom	groupid	org.apache.tomcat.embed	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.24	High
Version	Manifest	Bundle-Version	11.0.24	High
Version	Manifest	Implementation-Version	11.0.24	High
Version	pom	version	11.0.24	Highest

Identifiers

pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@11.0.24 (Confidence:High)

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-el/9.0.121/tomcat-embed-el-9.0.121.jar
MD5: 88894f74604cd2d600ab04e394d61fe9
SHA1: 3b68e6f0eb1860939127049f17c9fab05ebd0d32
SHA256:78d01fb146edab47f71a0c66b7892e4253008cda43cccfab38a51f9d527c98d2
Referenced In Projects/Scopes:

waffle-demo-spring-boot-filter2:compile
waffle-distro:runtime
waffle-spring-boot-autoconfigure2:compile

pkg:maven/com.github.waffle.demo/waffle-demo-spring-boot-filter2@3.6.1-SNAPSHOT
pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.18

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-embed-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	el	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-embed-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el",osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-embed-el	Highest
Vendor	pom	artifactid	tomcat-embed-el	Low
Vendor	pom	groupid	org.apache.tomcat.embed	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-embed-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	expressionfactory	Highest
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-embed-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-embed-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el",osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Product	pom	artifactid	tomcat-embed-el	Highest
Product	pom	groupid	org.apache.tomcat.embed	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	Manifest	Implementation-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Identifiers

pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@9.0.121 (Confidence:High)

Description:

Interface code to the native connector

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jni/10.1.59/tomcat-jni-10.1.59.jar
MD5: ff9bfc8619cb1970e7848606a96f9e2e
SHA1: 0a50da5024463a14fe35697c0e6597bf0af8c542
SHA256:096f57d9b59db917a9ce538701fbbcf58ac3b4f1f22a6c71c3cfb2e528688d9b
Referenced In Project/Scope: waffle-tomcat10:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-jni	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	jni	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jni	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-jni	Highest
Vendor	pom	artifactid	tomcat-jni	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-jni	High
Product	jar	package name	apache	Highest
Product	jar	package name	jni	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-jni	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jni	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-jni	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.59	High
Version	Manifest	Bundle-Version	10.1.59	High
Version	Manifest	Implementation-Version	10.1.59	High
Version	pom	version	10.1.59	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-jni@10.1.59 (Confidence:High)

Description:

Interface code to the native connector

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jni/11.0.25/tomcat-jni-11.0.25.jar
MD5: 6f12e10831bddad7048b8a020637181b
SHA1: 61eb6e98c6b23bc8d50fd6a8c0c30cd5519032be
SHA256:497d6532148288c0eae770f5976082d2274d6304e7026183281de9c29fc2b8cb
Referenced In Project/Scope: waffle-tomcat11:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-jni	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	jni	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jni	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-jni	Highest
Vendor	pom	artifactid	tomcat-jni	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-jni	High
Product	jar	package name	apache	Highest
Product	jar	package name	jni	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-jni	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jni	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-jni	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.25	High
Version	Manifest	Bundle-Version	11.0.25	High
Version	Manifest	Implementation-Version	11.0.25	High
Version	pom	version	11.0.25	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-jni@11.0.25 (Confidence:High)

Description:

Interface code to the native connector

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-jni/9.0.121/tomcat-jni-9.0.121.jar
MD5: 6b97e11aca11447a72ae953b4f2c5755
SHA1: 5de51bacb40e5e07dd5440eb4e799baf86854ce5
SHA256:e74c1730e0cae59c94dd815c06d533f4808ce2674388865598fc9b45974ef5d6
Referenced In Project/Scope: waffle-tomcat9:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.121

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-jni	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	jni	Highest
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jni	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-jni	Highest
Vendor	pom	artifactid	tomcat-jni	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-jni	High
Product	jar	package name	apache	Highest
Product	jar	package name	jni	Highest
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-jni	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jni	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-jni	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	Manifest	Implementation-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-jni@9.0.121 (Confidence:High)

Description:

Tomcat Core Logging Package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-juli/10.1.59/tomcat-juli-10.1.59.jar
MD5: 9f68a5458318f311588577adca2416a4
SHA1: fe67c316a038983f06fe595a676b634cd59807e7
SHA256:83df7c64837fd51075f381b1ffbb5ecc442f8d6bc9b7db39faf2e5f6fb058c0c
Referenced In Project/Scope: waffle-tomcat10:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-juli	Highest
Vendor	pom	artifactid	tomcat-juli	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	logging	Highest
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-juli	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.59	High
Version	Manifest	Bundle-Version	10.1.59	High
Version	Manifest	Implementation-Version	10.1.59	High
Version	pom	version	10.1.59	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-juli@10.1.59 (Confidence:High)

Description:

Tomcat Core Logging Package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-juli/11.0.25/tomcat-juli-11.0.25.jar
MD5: b7576d40f48f7b5f083aed6b96bc3477
SHA1: 5941280221132eb2a351b89df94e1bb26f70a9aa
SHA256:38d05270255ff7ba19507bc9ba0b0c2d4ba312fa084d5c36c7e84cf4bdefa7d1
Referenced In Project/Scope: waffle-tomcat11:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-juli	Highest
Vendor	pom	artifactid	tomcat-juli	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	logging	Highest
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-juli	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.25	High
Version	Manifest	Bundle-Version	11.0.25	High
Version	Manifest	Implementation-Version	11.0.25	High
Version	pom	version	11.0.25	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-juli@11.0.25 (Confidence:High)

Description:

Tomcat Core Logging Package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-juli/9.0.121/tomcat-juli-9.0.121.jar
MD5: 537b6e05caf17750b9243dfe9d97692a
SHA1: d1b6f9effb8b4bb6b85c4f2bca500e141526208f
SHA256:25d1935444a85376336d3d9e5487d9aa5ce520f3773acf886e0a2b72f2c36b44
Referenced In Project/Scope: waffle-tomcat9:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.121

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	pom	artifactid	tomcat-juli	Highest
Vendor	pom	artifactid	tomcat-juli	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	logging	Highest
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	pom	artifactid	tomcat-juli	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	Manifest	Implementation-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-juli@9.0.121 (Confidence:High)

Description:

jakarta.servlet package

License:

        Apache License, Version 2.0 and
        Common Development And Distribution License (CDDL) Version 1.0 and
        Eclipse Public License - v 2.0
      : 
        http://www.apache.org/licenses/LICENSE-2.0.txt and
        https://opensource.org/license/CDDL-1.0 and
        https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-servlet-api/10.1.59/tomcat-servlet-api-10.1.59.jar
MD5: 8891ec9607019f941655b27faa697827
SHA1: 6d14c8920254258a32d87faa2bb7769388cb57d3
SHA256:06147a8df6c908e8cc90ab3c6b381cd90e68a37d36ac824713874f64830a2fa1
Referenced In Project/Scope: waffle-tomcat10:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.59

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-servlet-api	High
Vendor	jar	package name	jakarta	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaServlet;version:Version="6.0";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Vendor	manifest: jakarta/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-servlet-api	Highest
Vendor	pom	artifactid	tomcat-servlet-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	jakarta	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaServlet;version:Version="6.0";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Product	manifest: jakarta/servlet/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/http/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/http/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/resources/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/resources/	Specification-Title	Jakarta Servlet	Medium
Product	pom	artifactid	tomcat-servlet-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	10.1.59	High
Version	Manifest	Bundle-Version	10.1.59	High
Version	pom	version	10.1.59	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.59 (Confidence:High)

Description:

jakarta.servlet package

License:

        Apache License, Version 2.0 and
        Common Development And Distribution License (CDDL) Version 1.0 and
        Eclipse Public License - v 2.0
      : 
        http://www.apache.org/licenses/LICENSE-2.0.txt and
        https://opensource.org/license/CDDL-1.0 and
        https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-servlet-api/11.0.25/tomcat-servlet-api-11.0.25.jar
MD5: 5df1ff39253f07faba0eb63f154206e1
SHA1: 55ceb77941e9a590beea459ec354d03d891185a8
SHA256:b4b58bdfcd171cb679c5235cb8b9cd9119f4802fe18d2e0be5e4c3695c53f08e
Referenced In Project/Scope: waffle-tomcat11:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.25

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-servlet-api	High
Vendor	jar	package name	jakarta	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaServlet;version:Version="6.1";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Vendor	manifest: jakarta/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: jakarta/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-servlet-api	Highest
Vendor	pom	artifactid	tomcat-servlet-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	jakarta	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JakartaServlet;version:Version="6.1";uses:="jakarta.servlet,jakarta.servlet.annotation,jakarta.servlet.descriptor,jakarta.servlet.http,jakarta.servlet.resources"	Low
Product	manifest: jakarta/servlet/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/annotation/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/descriptor/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/http/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/http/	Specification-Title	Jakarta Servlet	Medium
Product	manifest: jakarta/servlet/resources/	Implementation-Title	jakarta.servlet	Medium
Product	manifest: jakarta/servlet/resources/	Specification-Title	Jakarta Servlet	Medium
Product	pom	artifactid	tomcat-servlet-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	11.0.25	High
Version	Manifest	Bundle-Version	11.0.25	High
Version	pom	version	11.0.25	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-servlet-api@11.0.25 (Confidence:High)

Description:

javax.servlet package

License:

        Apache License, Version 2.0 and
        Common Development And Distribution License (CDDL) Version 1.0
      : 
        http://www.apache.org/licenses/LICENSE-2.0.txt and
        https://opensource.org/license/CDDL-1.0 and

File Path: /home/runner/.m2/repository/org/apache/tomcat/tomcat-servlet-api/9.0.121/tomcat-servlet-api-9.0.121.jar
MD5: 6e4dafe99e2cd577f7541feea5f0d61b
SHA1: 24ca5e6fe80224978b66e790076db26dc474d1c8
SHA256:0f159801d08e976f1a6959b8527ed3a86c7faaa5d2cb2b0bde6793e4858785f1
Referenced In Project/Scope: waffle-tomcat9:provided
pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.121

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-servlet-api	High
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	pom	artifactid	tomcat-servlet-api	Highest
Vendor	pom	artifactid	tomcat-servlet-api	Low
Vendor	pom	groupid	org.apache.tomcat	Highest
Vendor	pom	url	https://tomcat.apache.org/	Highest
Product	file	name	tomcat-servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Product	pom	artifactid	tomcat-servlet-api	Highest
Product	pom	groupid	org.apache.tomcat	Highest
Product	pom	url	https://tomcat.apache.org/	Medium
Version	file	version	9.0.121	High
Version	Manifest	Bundle-Version	9.0.121	High
Version	pom	version	9.0.121	Highest

Identifiers

pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.121 (Confidence:High)

How to read the report | Suppressing false positives | Getting Help: github issues

Project: waffle

com.github.waffle:waffle:3.6.1-SNAPSHOT

Summary

Dependencies (vulnerable)

ant-1.10.8.jar

Evidence

Related Dependencies

Identifiers

Published Vulnerabilities

asm-9.10.1.jar

Evidence

Identifiers

asm-commons-9.10.1.jar

Evidence

Identifiers

asm-tree-9.10.1.jar

Evidence

Identifiers

bcprov-jdk18on-1.84.jar

Evidence

Identifiers

bcprov-jdk18on-1.85.2.jar

Evidence

Identifiers

byte-buddy-1.18.13-jdk5.jar

Evidence

Identifiers

byte-buddy-agent-1.18.13-jdk5.jar

Evidence

Identifiers

byte-buddy-agent-1.18.13-jdk5.jar: attach_hotspot_windows.dll

Evidence

Identifiers

byte-buddy-agent-1.18.13-jdk5.jar: attach_hotspot_windows.dll

Evidence

Identifiers

byte-buddy-agent-1.18.13-jdk5.jar: attach_hotspot_windows.dll

Evidence

Identifiers

caffeine-3.2.4.jar

Evidence

Identifiers

checker-qual-4.2.3.jar

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-filter-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-form-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-jaas-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-mixed-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-mixed-post-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-negotiate-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-spring-boot-filter3:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-spring-filter-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo.jakarta:waffle-demo-spring-form-jakarta:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo:waffle-demo-filter:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo:waffle-demo-form:3.6.1-SNAPSHOT

Evidence

Identifiers

com.github.waffle.demo:waffle-demo-jaas:3.6.1-SNAPSHOT