Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 13.0.0
Report Generated On: Sun, 13 Sep 2026 00:48:14 GMT
Dependencies Scanned: 31 (20 unique)
Vulnerable Dependencies: 1
Vulnerabilities Found: 1
Vulnerabilities Suppressed: 0
...
NVD API Last Checked: 2026-09-13T00:18:53Z
NVD API Last Modified: 2026-09-13T00:17:07Z

Summary

Summary of Vulnerable Dependencies (click to show all)

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
bcprov-jdk18on-1.84.jar	cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.84:::::::*	pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84		0	Highest	49
caffeine-3.2.4.jar		pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4		0		33
checker-qual-4.2.3.jar		pkg:maven/org.checkerframework/checker-qual@4.2.3		0		44
com.github.waffle:waffle-jna:3.6.1-SNAPSHOT		pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT		0		6
commons-beanutils-1.11.0.jar	cpe:2.3:a:apache:commons_beanutils:1.11.0:::::::*	pkg:maven/commons-beanutils/commons-beanutils@1.11.0		0	Highest	170
commons-logging-1.3.5.jar		pkg:maven/commons-logging/commons-logging@1.3.5		0		129
encoder-1.4.0.jar		pkg:maven/org.owasp.encoder/encoder@1.4.0		0		33
error_prone_annotations-2.50.0.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0		0		29
j2objc-annotations-3.1.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.1		0		33
jakarta.servlet-api-4.0.4.jar		pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.4		0		43
jna-5.19.1.jar		pkg:maven/net.java.dev.jna/jna@5.19.1		0		48
jna-5.19.1.jar: jnidispatch.dll				0		2
jna-5.19.1.jar: jnidispatch.dll				0		2
jna-5.19.1.jar: jnidispatch.dll				0		2
jna-platform-5.19.1.jar		pkg:maven/net.java.dev.jna/jna-platform@5.19.1		0		42
jspecify-1.0.0.jar		pkg:maven/org.jspecify/jspecify@1.0.0		0		32
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
shiro-core-2.2.1.jar	cpe:2.3:a:apache:shiro:2.2.1:::::::*	pkg:maven/org.apache.shiro/shiro-core@2.2.1	MEDIUM	1	Highest	33
slf4j-api-2.0.19.jar		pkg:maven/org.slf4j/slf4j-api@2.0.19		0		29
spotbugs-annotations-4.10.4.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4		0		53

Dependencies (vulnerable)

bcprov-jdk18on-1.84.jar

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the  JCA/JCE provider and low-level API for the BC Java version 1.84 for Java 1.8 and later.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html

File Path: /home/runner/.m2/repository/org/bouncycastle/bcprov-jdk18on/1.84/bcprov-jdk18on-1.84.jar
MD5: 19523b0cbcbce2fdeb98e3eaf68f602e
SHA1: 2d5651789941d2f8ae9b8771f23356de6b61e96b
SHA256:64d6c5a6121fcd927152dd182cbed39afe0fda641a970d9bcc0c9cb1858b2731
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/org.apache.shiro/shiro-web@2.2.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bcprov-jdk18on	High
Vendor	jar	package name	bc	Highest
Vendor	jar	package name	bouncycastle	Highest
Vendor	jar	package name	crypto	Highest
Vendor	jar	package name	jce	Highest
Vendor	jar	package name	org	Highest
Vendor	jar	package name	provider	Highest
Vendor	Manifest	application-library-allowable-codebase	*	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Vendor	Manifest	bundle-symbolicname	bcprov	Medium
Vendor	Manifest	caller-allowable-codebase	*	Low
Vendor	Manifest	codebase	*	Low
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	permissions	all-permissions	Low
Vendor	Manifest	trusted-library	true	Low
Vendor	pom	artifactid	bcprov-jdk18on	Highest
Vendor	pom	artifactid	bcprov-jdk18on	Low
Vendor	pom	developer email	feedback-crypto@bouncycastle.org	Low
Vendor	pom	developer id	feedback-crypto	Medium
Vendor	pom	developer name	The Legion of the Bouncy Castle Inc.	Medium
Vendor	pom	groupid	org.bouncycastle	Highest
Vendor	pom	name	Bouncy Castle Provider	High
Vendor	pom	url	https://www.bouncycastle.org/download/bouncy-castle-java/	Highest
Product	file	name	bcprov-jdk18on	High
Product	jar	package name	bc	Highest
Product	jar	package name	bouncycastle	Highest
Product	jar	package name	crypto	Highest
Product	jar	package name	jce	Highest
Product	jar	package name	org	Highest
Product	jar	package name	provider	Highest
Product	Manifest	application-library-allowable-codebase	*	Low
Product	Manifest	Bundle-Name	bcprov	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Product	Manifest	bundle-symbolicname	bcprov	Medium
Product	Manifest	caller-allowable-codebase	*	Low
Product	Manifest	codebase	*	Low
Product	Manifest	multi-release	true	Low
Product	Manifest	permissions	all-permissions	Low
Product	Manifest	trusted-library	true	Low
Product	pom	artifactid	bcprov-jdk18on	Highest
Product	pom	developer email	feedback-crypto@bouncycastle.org	Low
Product	pom	developer id	feedback-crypto	Low
Product	pom	developer name	The Legion of the Bouncy Castle Inc.	Low
Product	pom	groupid	org.bouncycastle	Highest
Product	pom	name	Bouncy Castle Provider	High
Product	pom	url	https://www.bouncycastle.org/download/bouncy-castle-java/	Medium
Version	file	version	1.84	High
Version	Manifest	Bundle-Version	1.84	High
Version	pom	version	1.84	Highest

Identifiers

pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84 (Confidence:High)
cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.84:*:*:*:*:*:*:* (Confidence:Highest)

caffeine-3.2.4.jar

Description:

A high performance caching library

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/github/ben-manes/caffeine/caffeine/3.2.4/caffeine-3.2.4.jar
MD5: 04d655feb58be297a86fa2814a1f1ef8
SHA1: c63b303adf59c733d2a96125ad6670e938a2c15d
SHA256:9d9d2cfd681fd9272ded3d27c9930db12f89f732345975aa113ebc223bbf1224
Referenced In Project/Scope: waffle-shiro:compile
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	caffeine	High
Vendor	jar	package name	cache	Highest
Vendor	jar	package name	caffeine	Highest
Vendor	jar	package name	github	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	com.github.ben-manes.caffeine	Medium
Vendor	pom	artifactid	caffeine	Highest
Vendor	pom	artifactid	caffeine	Low
Vendor	pom	developer email	ben.manes@gmail.com	Low
Vendor	pom	developer id	ben-manes	Medium
Vendor	pom	developer name	Ben Manes	Medium
Vendor	pom	groupid	com.github.ben-manes.caffeine	Highest
Vendor	pom	name	Caffeine cache	High
Vendor	pom	url	ben-manes/caffeine	Highest
Product	file	name	caffeine	High
Product	jar	package name	cache	Highest
Product	jar	package name	caffeine	Highest
Product	jar	package name	github	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	com.github.ben-manes.caffeine	Medium
Product	Manifest	bundle-symbolicname	com.github.ben-manes.caffeine	Medium
Product	Manifest	Implementation-Title	A high performance caching library	High
Product	pom	artifactid	caffeine	Highest
Product	pom	developer email	ben.manes@gmail.com	Low
Product	pom	developer id	ben-manes	Low
Product	pom	developer name	Ben Manes	Low
Product	pom	groupid	com.github.ben-manes.caffeine	Highest
Product	pom	name	Caffeine cache	High
Product	pom	url	ben-manes/caffeine	High
Version	file	version	3.2.4	High
Version	Manifest	Bundle-Version	3.2.4	High
Version	Manifest	Implementation-Version	3.2.4	High
Version	pom	version	3.2.4	Highest

Identifiers

pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4 (Confidence:High)

checker-qual-4.2.3.jar

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: https://opensource.org/licenses/MIT

File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/4.2.3/checker-qual-4.2.3.jar
MD5: d9e63a451931be32bd29cfc3ac5674c1
SHA1: d2a10af5c8574adfe24f5e35ff56cca92af2e916
SHA256:f868f731f6e37db3e1c2140d06016477989959a2d13fc5bed9c46760cffd5ba0
Referenced In Project/Scope: waffle-shiro:compile
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	4.2.3	High
Version	Manifest	Bundle-Version	4.2.3	High
Version	Manifest	Implementation-Version	4.2.3	High
Version	pom	version	4.2.3	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@4.2.3 (Confidence:High)

com.github.waffle:waffle-jna:3.6.1-SNAPSHOT

Description:

WAFFLE JNA implementation

License:

MIT https://opensource.org/licenses/MIT

File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna/pom.xml

Referenced In Project/Scope: waffle-shiro
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	pom	High
Vendor	project	artifactid	waffle-jna	Low
Vendor	project	groupid	com.github.waffle	Highest
Product	file	name	pom	High
Product	project	artifactid	waffle-jna	Highest
Product	project	groupid	com.github.waffle	Low

Identifiers

pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT (Confidence:Highest)

commons-beanutils-1.11.0.jar

Description:

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/commons-beanutils/commons-beanutils/1.11.0/commons-beanutils-1.11.0.jar
MD5: 32ed51f196dfda19e0dc1ce53eeed29e
SHA1: ac03ea606d13de04c2e4508227680faff151f491
SHA256:9e44ba68ec9a3f21286fa2a8bbb003b735c0f69101bb43144b79f4f8aaa74709
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-beanutils	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	beanutils	Highest
Vendor	jar	package name	commons	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-beanutils	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-beanutils	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-beanutils	Highest
Vendor	pom	artifactid	commons-beanutils	Low
Vendor	pom	developer email	britter@apache.org	Low
Vendor	pom	developer email	chtompki@apache.org	Low
Vendor	pom	developer email	craigmcc@apache.org	Low
Vendor	pom	developer email	dion@apache.org	Low
Vendor	pom	developer email	epugh@apache.org	Low
Vendor	pom	developer email	geirm@apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jcarman@apache.org	Low
Vendor	pom	developer email	jconlon@apache.org	Low
Vendor	pom	developer email	jstrachan@apache.org	Low
Vendor	pom	developer email	morgand@apache.org	Low
Vendor	pom	developer email	mvdb@apache.org	Low
Vendor	pom	developer email	niallp@apache.org	Low
Vendor	pom	developer email	rdonkin@apache.org	Low
Vendor	pom	developer email	rwaldhoff@apache.org	Low
Vendor	pom	developer email	sanders@apache.org	Low
Vendor	pom	developer email	scolebourne@apache.org	Low
Vendor	pom	developer email	skitching@apache.org	Low
Vendor	pom	developer email	stain@apache.org	Low
Vendor	pom	developer email	tobrien@apache.org	Low
Vendor	pom	developer email	yoavs@apache.org	Low
Vendor	pom	developer id	britter	Medium
Vendor	pom	developer id	chtompki	Medium
Vendor	pom	developer id	craigmcc	Medium
Vendor	pom	developer id	dion	Medium
Vendor	pom	developer id	epugh	Medium
Vendor	pom	developer id	geirm	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jcarman	Medium
Vendor	pom	developer id	jconlon	Medium
Vendor	pom	developer id	jstrachan	Medium
Vendor	pom	developer id	morgand	Medium
Vendor	pom	developer id	mvdb	Medium
Vendor	pom	developer id	niallp	Medium
Vendor	pom	developer id	rdonkin	Medium
Vendor	pom	developer id	rwaldhoff	Medium
Vendor	pom	developer id	sanders	Medium
Vendor	pom	developer id	scolebourne	Medium
Vendor	pom	developer id	skitching	Medium
Vendor	pom	developer id	stain	Medium
Vendor	pom	developer id	tobrien	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Benedikt Ritter	Medium
Vendor	pom	developer name	Craig McClanahan	Medium
Vendor	pom	developer name	David Eric Pugh	Medium
Vendor	pom	developer name	Dion Gillard	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Geir Magnusson Jr.	Medium
Vendor	pom	developer name	James Carman	Medium
Vendor	pom	developer name	James Strachan	Medium
Vendor	pom	developer name	John E. Conlon	Medium
Vendor	pom	developer name	Martin van den Bemt	Medium
Vendor	pom	developer name	Morgan James Delagrange	Medium
Vendor	pom	developer name	Niall Pemberton	Medium
Vendor	pom	developer name	Rob Tompkins	Medium
Vendor	pom	developer name	Robert Burrell Donkin	Medium
Vendor	pom	developer name	Rodney Waldhoff	Medium
Vendor	pom	developer name	Scott Sanders	Medium
Vendor	pom	developer name	Simon Kitching	Medium
Vendor	pom	developer name	Stephen Colebourne	Medium
Vendor	pom	developer name	Stian Soiland-Reyes	Medium
Vendor	pom	developer name	Tim O'Brien	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-beanutils	Highest
Vendor	pom	name	Apache Commons BeanUtils	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-beanutils	Highest
Product	file	name	commons-beanutils	High
Product	jar	package name	apache	Highest
Product	jar	package name	beanutils	Highest
Product	jar	package name	commons	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-beanutils	Low
Product	Manifest	Bundle-Name	Apache Commons BeanUtils	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-beanutils	Medium
Product	Manifest	Implementation-Title	Apache Commons BeanUtils	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons BeanUtils	Medium
Product	pom	artifactid	commons-beanutils	Highest
Product	pom	developer email	britter@apache.org	Low
Product	pom	developer email	chtompki@apache.org	Low
Product	pom	developer email	craigmcc@apache.org	Low
Product	pom	developer email	dion@apache.org	Low
Product	pom	developer email	epugh@apache.org	Low
Product	pom	developer email	geirm@apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jcarman@apache.org	Low
Product	pom	developer email	jconlon@apache.org	Low
Product	pom	developer email	jstrachan@apache.org	Low
Product	pom	developer email	morgand@apache.org	Low
Product	pom	developer email	mvdb@apache.org	Low
Product	pom	developer email	niallp@apache.org	Low
Product	pom	developer email	rdonkin@apache.org	Low
Product	pom	developer email	rwaldhoff@apache.org	Low
Product	pom	developer email	sanders@apache.org	Low
Product	pom	developer email	scolebourne@apache.org	Low
Product	pom	developer email	skitching@apache.org	Low
Product	pom	developer email	stain@apache.org	Low
Product	pom	developer email	tobrien@apache.org	Low
Product	pom	developer email	yoavs@apache.org	Low
Product	pom	developer id	britter	Low
Product	pom	developer id	chtompki	Low
Product	pom	developer id	craigmcc	Low
Product	pom	developer id	dion	Low
Product	pom	developer id	epugh	Low
Product	pom	developer id	geirm	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jcarman	Low
Product	pom	developer id	jconlon	Low
Product	pom	developer id	jstrachan	Low
Product	pom	developer id	morgand	Low
Product	pom	developer id	mvdb	Low
Product	pom	developer id	niallp	Low
Product	pom	developer id	rdonkin	Low
Product	pom	developer id	rwaldhoff	Low
Product	pom	developer id	sanders	Low
Product	pom	developer id	scolebourne	Low
Product	pom	developer id	skitching	Low
Product	pom	developer id	stain	Low
Product	pom	developer id	tobrien	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Benedikt Ritter	Low
Product	pom	developer name	Craig McClanahan	Low
Product	pom	developer name	David Eric Pugh	Low
Product	pom	developer name	Dion Gillard	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Geir Magnusson Jr.	Low
Product	pom	developer name	James Carman	Low
Product	pom	developer name	James Strachan	Low
Product	pom	developer name	John E. Conlon	Low
Product	pom	developer name	Martin van den Bemt	Low
Product	pom	developer name	Morgan James Delagrange	Low
Product	pom	developer name	Niall Pemberton	Low
Product	pom	developer name	Rob Tompkins	Low
Product	pom	developer name	Robert Burrell Donkin	Low
Product	pom	developer name	Rodney Waldhoff	Low
Product	pom	developer name	Scott Sanders	Low
Product	pom	developer name	Simon Kitching	Low
Product	pom	developer name	Stephen Colebourne	Low
Product	pom	developer name	Stian Soiland-Reyes	Low
Product	pom	developer name	Tim O'Brien	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-beanutils	Highest
Product	pom	name	Apache Commons BeanUtils	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-beanutils	Medium
Version	file	version	1.11.0	High
Version	Manifest	Bundle-Version	1.11.0	High
Version	Manifest	Implementation-Version	1.11.0	High
Version	pom	parent-version	1.11.0	Low
Version	pom	version	1.11.0	Highest

Identifiers

pkg:maven/commons-beanutils/commons-beanutils@1.11.0 (Confidence:High)
cpe:2.3:a:apache:commons_beanutils:1.11.0:*:*:*:*:*:*:* (Confidence:Highest)

commons-logging-1.3.5.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.3.5/commons-logging-1.3.5.jar
MD5: 9ca067b073153c86c2da350c0f2cdf70
SHA1: a3fcc5d3c29b2b03433aa2d2f2d2c1b1638924a1
SHA256:6d7a744e4027649fbb50895df9497d109f98c766a637062fe8d2eabbb3140ba4
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/commons-beanutils/commons-beanutils@1.11.0

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-logging	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	logging	Highest
Vendor	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-logging	Highest
Vendor	pom	artifactid	commons-logging	Low
Vendor	pom	developer email	baliuka@apache.org	Low
Vendor	pom	developer email	costin@apache.org	Low
Vendor	pom	developer email	craigmcc@apache.org	Low
Vendor	pom	developer email	dennisl@apache.org	Low
Vendor	pom	developer email	donaldp@apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	morgand@apache.org	Low
Vendor	pom	developer email	rdonkin@apache.org	Low
Vendor	pom	developer email	rsitze@apache.org	Low
Vendor	pom	developer email	rwaldhoff@apache.org	Low
Vendor	pom	developer email	sanders@apache.org	Low
Vendor	pom	developer email	skitching@apache.org	Low
Vendor	pom	developer email	tn@apache.org	Low
Vendor	pom	developer id	baliuka	Medium
Vendor	pom	developer id	bstansberry	Medium
Vendor	pom	developer id	costin	Medium
Vendor	pom	developer id	craigmcc	Medium
Vendor	pom	developer id	dennisl	Medium
Vendor	pom	developer id	donaldp	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	morgand	Medium
Vendor	pom	developer id	rdonkin	Medium
Vendor	pom	developer id	rsitze	Medium
Vendor	pom	developer id	rwaldhoff	Medium
Vendor	pom	developer id	sanders	Medium
Vendor	pom	developer id	skitching	Medium
Vendor	pom	developer id	tn	Medium
Vendor	pom	developer name	Brian Stansberry	Medium
Vendor	pom	developer name	Costin Manolache	Medium
Vendor	pom	developer name	Craig McClanahan	Medium
Vendor	pom	developer name	Dennis Lundberg	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Juozas Baliuka	Medium
Vendor	pom	developer name	Morgan Delagrange	Medium
Vendor	pom	developer name	Peter Donald	Medium
Vendor	pom	developer name	Richard Sitze	Medium
Vendor	pom	developer name	Robert Burrell Donkin	Medium
Vendor	pom	developer name	Rodney Waldhoff	Medium
Vendor	pom	developer name	Scott Sanders	Medium
Vendor	pom	developer name	Simon Kitching	Medium
Vendor	pom	developer name	Thomas Neidhart	Medium
Vendor	pom	developer org	Apache	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-logging	Highest
Vendor	pom	name	Apache Commons Logging	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-logging/	Highest
Product	file	name	commons-logging	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	logging	Highest
Product	Manifest	automatic-module-name	org.apache.commons.logging	Medium
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-logging/	Low
Product	Manifest	Bundle-Name	Apache Commons Logging	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-logging	Medium
Product	Manifest	Implementation-Title	Apache Commons Logging	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Logging	Medium
Product	pom	artifactid	commons-logging	Highest
Product	pom	developer email	baliuka@apache.org	Low
Product	pom	developer email	costin@apache.org	Low
Product	pom	developer email	craigmcc@apache.org	Low
Product	pom	developer email	dennisl@apache.org	Low
Product	pom	developer email	donaldp@apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	morgand@apache.org	Low
Product	pom	developer email	rdonkin@apache.org	Low
Product	pom	developer email	rsitze@apache.org	Low
Product	pom	developer email	rwaldhoff@apache.org	Low
Product	pom	developer email	sanders@apache.org	Low
Product	pom	developer email	skitching@apache.org	Low
Product	pom	developer email	tn@apache.org	Low
Product	pom	developer id	baliuka	Low
Product	pom	developer id	bstansberry	Low
Product	pom	developer id	costin	Low
Product	pom	developer id	craigmcc	Low
Product	pom	developer id	dennisl	Low
Product	pom	developer id	donaldp	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	morgand	Low
Product	pom	developer id	rdonkin	Low
Product	pom	developer id	rsitze	Low
Product	pom	developer id	rwaldhoff	Low
Product	pom	developer id	sanders	Low
Product	pom	developer id	skitching	Low
Product	pom	developer id	tn	Low
Product	pom	developer name	Brian Stansberry	Low
Product	pom	developer name	Costin Manolache	Low
Product	pom	developer name	Craig McClanahan	Low
Product	pom	developer name	Dennis Lundberg	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Juozas Baliuka	Low
Product	pom	developer name	Morgan Delagrange	Low
Product	pom	developer name	Peter Donald	Low
Product	pom	developer name	Richard Sitze	Low
Product	pom	developer name	Robert Burrell Donkin	Low
Product	pom	developer name	Rodney Waldhoff	Low
Product	pom	developer name	Scott Sanders	Low
Product	pom	developer name	Simon Kitching	Low
Product	pom	developer name	Thomas Neidhart	Low
Product	pom	developer org	Apache	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-logging	Highest
Product	pom	name	Apache Commons Logging	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-logging/	Medium
Version	file	version	1.3.5	High
Version	Manifest	Bundle-Version	1.3.5	High
Version	Manifest	Implementation-Version	1.3.5	High
Version	pom	parent-version	1.3.5	Low
Version	pom	version	1.3.5	Highest

Identifiers

pkg:maven/commons-logging/commons-logging@1.3.5 (Confidence:High)

encoder-1.4.0.jar

Description:

        The OWASP Encoders package is a collection of high-performance low-overhead
        contextual encoders, that when utilized correctly, is an effective tool in
        preventing Web Application security vulnerabilities such as Cross-Site
        Scripting.

License:

http://www.opensource.org/licenses/BSD-3-Clause

File Path: /home/runner/.m2/repository/org/owasp/encoder/encoder/1.4.0/encoder-1.4.0.jar
MD5: d26a36885af1fd62e8a3c18ec51ed39c
SHA1: 41560c4db1cae2290402eee6ea0db544e8d48b7f
SHA256:90f9860925905dd97f313cffae065835eb02acc3e2e9b0051621693efd09025c
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/org.apache.shiro/shiro-web@2.2.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	encoder	High
Vendor	jar	package name	encoder	Highest
Vendor	jar	package name	encoders	Highest
Vendor	jar	package name	owasp	Highest
Vendor	Manifest	automatic-module-name	org.owasp.encoder	Medium
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://www.owasp.org/	Low
Vendor	Manifest	bundle-symbolicname	org.owasp.encoder	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin	Low
Vendor	pom	artifactid	encoder	Highest
Vendor	pom	artifactid	encoder	Low
Vendor	pom	groupid	org.owasp.encoder	Highest
Vendor	pom	name	Java Encoder	High
Vendor	pom	parent-artifactid	encoder-parent	Low
Product	file	name	encoder	High
Product	jar	package name	encoder	Highest
Product	jar	package name	encoders	Highest
Product	jar	package name	owasp	Highest
Product	Manifest	automatic-module-name	org.owasp.encoder	Medium
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://www.owasp.org/	Low
Product	Manifest	Bundle-Name	Java Encoder	Medium
Product	Manifest	bundle-symbolicname	org.owasp.encoder	Medium
Product	Manifest	multi-release	true	Low
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin	Low
Product	pom	artifactid	encoder	Highest
Product	pom	groupid	org.owasp.encoder	Highest
Product	pom	name	Java Encoder	High
Product	pom	parent-artifactid	encoder-parent	Medium
Version	file	version	1.4.0	High
Version	Manifest	Bundle-Version	1.4.0	High
Version	pom	version	1.4.0	Highest

Identifiers

pkg:maven/org.owasp.encoder/encoder@1.4.0 (Confidence:High)

error_prone_annotations-2.50.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.50.0/error_prone_annotations-2.50.0.jar
MD5: 1ded1848cfd4f5167e00824faf9c4d3b
SHA1: 74ba43e49ab1184d41634af2ef0047e82c4064b0
SHA256:4667724877f1d37a689202da191e23efa7657c62eef93ccdac406eccfe5cdd0a
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.50.0	High
Version	Manifest	Bundle-Version	2.50.0	High
Version	pom	version	2.50.0	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0 (Confidence:High)

j2objc-annotations-3.1.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.1/j2objc-annotations-3.1.jar
MD5: abe8bd3abff622b9a8b15c3a737aa741
SHA1: a892ca9507839bbdb900d64310ac98256cab992f
SHA256:84d3a150518485f8140ea99b8a985656749629f6433c92b80c75b36aba3b099b
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	22	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	22	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.1	High
Version	pom	version	3.1	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.1 (Confidence:High)

jakarta.servlet-api-4.0.4.jar

Description:

Jakarta Servlet 4.0

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html

File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/4.0.4/jakarta.servlet-api-4.0.4.jar
MD5: f5d1d7a29978e4ae0be5a456ee1c65c3
SHA1: b8a1142e04838fe54194049c6e7a18dae8f9b960
SHA256:586e27706c21258f5882f43be06904f49b02db9ac54e345d393fe4a32494d127
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jakarta.servlet-api	High
Vendor	jar	package name	javax	Highest
Vendor	jar	package name	servlet	Highest
Vendor	Manifest	automatic-module-name	java.servlet	Medium
Vendor	Manifest	bundle-docurl	https://www.eclipse.org	Low
Vendor	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Vendor	Manifest	extension-name	javax.servlet	Medium
Vendor	Manifest	Implementation-Vendor	Eclipse Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.eclipse	Medium
Vendor	Manifest	specification-vendor	Eclipse Foundation	Low
Vendor	pom	artifactid	jakarta.servlet-api	Highest
Vendor	pom	artifactid	jakarta.servlet-api	Low
Vendor	pom	developer id	yaminikb	Medium
Vendor	pom	developer name	Yamini K B	Medium
Vendor	pom	developer org	Oracle Corporation	Medium
Vendor	pom	developer org URL	http://www.oracle.com/	Medium
Vendor	pom	groupid	jakarta.servlet	Highest
Vendor	pom	name	Jakarta Servlet	High
Vendor	pom	parent-artifactid	project	Low
Vendor	pom	parent-groupid	org.eclipse.ee4j	Medium
Vendor	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Highest
Product	file	name	jakarta.servlet-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	Manifest	automatic-module-name	java.servlet	Medium
Product	Manifest	bundle-docurl	https://www.eclipse.org	Low
Product	Manifest	Bundle-Name	Jakarta Servlet	Medium
Product	Manifest	bundle-symbolicname	jakarta.servlet-api	Medium
Product	Manifest	extension-name	javax.servlet	Medium
Product	pom	artifactid	jakarta.servlet-api	Highest
Product	pom	developer id	yaminikb	Low
Product	pom	developer name	Yamini K B	Low
Product	pom	developer org	Oracle Corporation	Low
Product	pom	developer org URL	http://www.oracle.com/	Low
Product	pom	groupid	jakarta.servlet	Highest
Product	pom	name	Jakarta Servlet	High
Product	pom	parent-artifactid	project	Medium
Product	pom	parent-groupid	org.eclipse.ee4j	Medium
Product	pom	url	https://projects.eclipse.org/projects/ee4j.servlet	Medium
Version	file	version	4.0.4	High
Version	Manifest	Implementation-Version	4.0.4	High
Version	pom	parent-version	4.0.4	Low
Version	pom	version	4.0.4	Highest

Identifiers

pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.4 (Confidence:High)

jna-5.19.1.jar

Description:

Java Native Access

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar
MD5: cf327da3e9cf5a5d77c8a43540320929
SHA1: ca303052cd617c1af2e2c8d344c98a706fb63143
SHA256:4fb141dd8ef6b0585ffceea4bc49602fbc6312fa977e2c488794ea3e6aafecae
Referenced In Project/Scope: waffle-shiro:compile
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jna	High
Vendor	jar	package name	jna	Highest
Vendor	jar	package name	native	Highest
Vendor	jar	package name	sun	Highest
Vendor	jar (hint)	package name	oracle	Highest
Vendor	Manifest	automatic-module-name	com.sun.jna	Medium
Vendor	Manifest	bundle-activationpolicy	lazy	Low
Vendor	Manifest	bundle-category	jni	Low
Vendor	Manifest	bundle-nativecode	com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win32, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win32, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win32, com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win, com/sun/jna/w32ce-arm/jnidispatch.dll; processor=arm;osname=wince, com/sun/jna/sunos-x86/libjnidispatch.so; processor=x86;osname=sunos, com/sun/jna/sunos-x86-64/libjnidispatch.so; processor=x86-64;osname=sunos, com/sun/jna/sunos-sparc/libjnidispatch.so; processor=sparc;osname=sunos, com/sun/jna/sunos-sparcv9/libjnidispatch.so; processor=sparcv9;osname=sunos, com/sun/jna/aix-ppc/libjnidispatch.a; processor=ppc;osname=aix, com/sun/jna/aix-ppc64/libjnidispatch.a; processor=ppc64;osname=aix, com/sun/jna/linux-ppc/libjnidispatch.so; processor=ppc;osname=linux, com/sun/jna/linux-ppc64/libjnidispatch.so; processor=ppc64;osname=linux, com/sun/jna/linux-ppc64le/libjnidispatch.so; processor=ppc64le;osname=linux, com/sun/jna/linux-x86/libjnidispatch.so; processor=x86;osname=linux, com/sun/jna/linux-x86-64/libjnidispatch.so; processor=x86-64;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm_le;osname=linux, com/sun/jna/linux-armel/libjnidispatch.so; processor=armel;osname=linux, com/sun/jna/linux-aarch64/libjnidispatch.so; processor=aarch64;osname=linux, com/sun/jna/linux-ia64/libjnidispatch.so; processor=ia64;osname=linux, com/sun/jna/linux-sparcv9/libjnidispatch.so; processor=sparcv9;osname=linux, com/sun/jna/linux-mips64el/libjnidispatch.so; processor=mips64el;osname=linux, com/sun/jna/linux-s390x/libjnidispatch.so; processor=S390x;osname=linux, com/sun/jna/linux-loongarch64/libjnidispatch.so; processor=loongarch64;osname=linux, com/sun/jna/linux-riscv64/libjnidispatch.so; processor=riscv64;osname=linux, com/sun/jna/dragonflybsd-x86-64/libjnidispatch.so; processor=x86-64;osname=dragonflybsd, com/sun/jna/freebsd-x86/libjnidispatch.so; processor=x86;osname=freebsd, com/sun/jna/freebsd-x86-64/libjnidispatch.so; processor=x86-64;osname=freebsd, com/sun/jna/freebsd-aarch64/libjnidispatch.so; processor=aarch64;osname=freebsd, com/sun/jna/freebsd-ppc64le/libjnidispatch.so; processor=ppc64le;osname=freebsd, com/sun/jna/freebsd-ppc64/libjnidispatch.so; processor=ppc64;osname=freebsd, com/sun/jna/openbsd-x86/libjnidispatch.so; processor=x86;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=x86-64;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=sparcv9;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=aarch64;osname=openbsd, com/sun/jna/darwin-ppc/libjnidispatch.jnilib; osname=macosx;processor=ppc, com/sun/jna/darwin-ppc64/libjnidispatch.jnilib; osname=macosx;processor=ppc64, com/sun/jna/darwin-x86/libjnidispatch.jnilib; osname=macosx;processor=x86, com/sun/jna/darwin-x86-64/libjnidispatch.jnilib; osname=macosx;processor=x86-64, com/sun/jna/darwin-aarch64/libjnidispatch.jnilib; osname=macosx;processor=aarch64	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.6	Low
Vendor	Manifest	bundle-symbolicname	com.sun.jna	Medium
Vendor	Manifest	Implementation-Vendor	JNA Development Team	High
Vendor	Manifest	specification-vendor	JNA Development Team	Low
Vendor	pom	artifactid	jna	Highest
Vendor	pom	artifactid	jna	Low
Vendor	pom	developer email	mblaesing@doppel-helix.eu	Low
Vendor	pom	developer id	twall	Medium
Vendor	pom	developer name	Matthias Bläsing	Medium
Vendor	pom	developer name	Timothy Wall	Medium
Vendor	pom	groupid	net.java.dev.jna	Highest
Vendor	pom	name	Java Native Access	High
Vendor	pom	url	java-native-access/jna	Highest
Product	file	name	jna	High
Product	jar	package name	jna	Highest
Product	jar	package name	library	Highest
Product	jar	package name	native	Highest
Product	jar	package name	sun	Highest
Product	jar	package name	win32	Highest
Product	Manifest	automatic-module-name	com.sun.jna	Medium
Product	Manifest	bundle-activationpolicy	lazy	Low
Product	Manifest	bundle-category	jni	Low
Product	Manifest	Bundle-Name	jna	Medium
Product	Manifest	bundle-nativecode	com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win32, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win32, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win32, com/sun/jna/win32-x86/jnidispatch.dll; processor=x86;osname=win, com/sun/jna/win32-x86-64/jnidispatch.dll; processor=x86-64;osname=win, com/sun/jna/win32-aarch64/jnidispatch.dll; processor=aarch64;osname=win, com/sun/jna/w32ce-arm/jnidispatch.dll; processor=arm;osname=wince, com/sun/jna/sunos-x86/libjnidispatch.so; processor=x86;osname=sunos, com/sun/jna/sunos-x86-64/libjnidispatch.so; processor=x86-64;osname=sunos, com/sun/jna/sunos-sparc/libjnidispatch.so; processor=sparc;osname=sunos, com/sun/jna/sunos-sparcv9/libjnidispatch.so; processor=sparcv9;osname=sunos, com/sun/jna/aix-ppc/libjnidispatch.a; processor=ppc;osname=aix, com/sun/jna/aix-ppc64/libjnidispatch.a; processor=ppc64;osname=aix, com/sun/jna/linux-ppc/libjnidispatch.so; processor=ppc;osname=linux, com/sun/jna/linux-ppc64/libjnidispatch.so; processor=ppc64;osname=linux, com/sun/jna/linux-ppc64le/libjnidispatch.so; processor=ppc64le;osname=linux, com/sun/jna/linux-x86/libjnidispatch.so; processor=x86;osname=linux, com/sun/jna/linux-x86-64/libjnidispatch.so; processor=x86-64;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm;osname=linux, com/sun/jna/linux-arm/libjnidispatch.so; processor=arm_le;osname=linux, com/sun/jna/linux-armel/libjnidispatch.so; processor=armel;osname=linux, com/sun/jna/linux-aarch64/libjnidispatch.so; processor=aarch64;osname=linux, com/sun/jna/linux-ia64/libjnidispatch.so; processor=ia64;osname=linux, com/sun/jna/linux-sparcv9/libjnidispatch.so; processor=sparcv9;osname=linux, com/sun/jna/linux-mips64el/libjnidispatch.so; processor=mips64el;osname=linux, com/sun/jna/linux-s390x/libjnidispatch.so; processor=S390x;osname=linux, com/sun/jna/linux-loongarch64/libjnidispatch.so; processor=loongarch64;osname=linux, com/sun/jna/linux-riscv64/libjnidispatch.so; processor=riscv64;osname=linux, com/sun/jna/dragonflybsd-x86-64/libjnidispatch.so; processor=x86-64;osname=dragonflybsd, com/sun/jna/freebsd-x86/libjnidispatch.so; processor=x86;osname=freebsd, com/sun/jna/freebsd-x86-64/libjnidispatch.so; processor=x86-64;osname=freebsd, com/sun/jna/freebsd-aarch64/libjnidispatch.so; processor=aarch64;osname=freebsd, com/sun/jna/freebsd-ppc64le/libjnidispatch.so; processor=ppc64le;osname=freebsd, com/sun/jna/freebsd-ppc64/libjnidispatch.so; processor=ppc64;osname=freebsd, com/sun/jna/openbsd-x86/libjnidispatch.so; processor=x86;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=x86-64;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=sparcv9;osname=openbsd, com/sun/jna/openbsd-x86-64/libjnidispatch.so; processor=aarch64;osname=openbsd, com/sun/jna/darwin-ppc/libjnidispatch.jnilib; osname=macosx;processor=ppc, com/sun/jna/darwin-ppc64/libjnidispatch.jnilib; osname=macosx;processor=ppc64, com/sun/jna/darwin-x86/libjnidispatch.jnilib; osname=macosx;processor=x86, com/sun/jna/darwin-x86-64/libjnidispatch.jnilib; osname=macosx;processor=x86-64, com/sun/jna/darwin-aarch64/libjnidispatch.jnilib; osname=macosx;processor=aarch64	Low
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.6	Low
Product	Manifest	bundle-symbolicname	com.sun.jna	Medium
Product	Manifest	Implementation-Title	com.sun.jna	High
Product	Manifest	specification-title	Java Native Access (JNA)	Medium
Product	pom	artifactid	jna	Highest
Product	pom	developer email	mblaesing@doppel-helix.eu	Low
Product	pom	developer id	twall	Low
Product	pom	developer name	Matthias Bläsing	Low
Product	pom	developer name	Timothy Wall	Low
Product	pom	groupid	net.java.dev.jna	Highest
Product	pom	name	Java Native Access	High
Product	pom	url	java-native-access/jna	High
Version	file	version	5.19.1	High
Version	Manifest	Bundle-Version	5.19.1	High
Version	pom	version	5.19.1	Highest

Identifiers

pkg:maven/net.java.dev.jna/jna@5.19.1 (Confidence:High)

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-aarch64/jnidispatch.dll
MD5: 302945a811fd8e21bcdd5226c73b6f74
SHA1: 6b05e299ff2b3eb3b7b7aeac44263f715693607c
SHA256:b8f98be314234cf12b5b46c29652f70c0f6abb93ae19b63d3fe2692062aa699d
Referenced In Project/Scope: waffle-shiro:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jnidispatch	High
Product	file	name	jnidispatch	High

Identifiers

None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86-64/jnidispatch.dll
MD5: 2d2475f1f026dd54e9f3e787ae4f81da
SHA1: 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA256:5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
Referenced In Project/Scope: waffle-shiro:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jnidispatch	High
Product	file	name	jnidispatch	High

Identifiers

None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86/jnidispatch.dll
MD5: 0caa1ef75a807f9dde05084fa2219a5c
SHA1: 2f5e1cd82cde192905c7510ce99037b67d980640
SHA256:752d597cee7e95cb517327146bf42f124c0d6c0bc48b3ecc3b1b3b0531a52f44
Referenced In Project/Scope: waffle-shiro:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jnidispatch	High
Product	file	name	jnidispatch	High

Identifiers

None

jna-platform-5.19.1.jar

Description:

Java Native Access Platform

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna-platform/5.19.1/jna-platform-5.19.1.jar
MD5: 1d97b6103a9b3b7ddb671908683f4566
SHA1: d1e54d9231da5ca3fa730d52960deaa555475468
SHA256:3b3864f5b449e9c3c24b16861524b622b086563f44e0cd8384c8efc5a6052f82
Referenced In Project/Scope: waffle-shiro:compile
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jna-platform	High
Vendor	jar	package name	jna	Highest
Vendor	jar	package name	platform	Highest
Vendor	jar	package name	sun	Highest
Vendor	jar (hint)	package name	oracle	Highest
Vendor	Manifest	automatic-module-name	com.sun.jna.platform	Medium
Vendor	Manifest	bundle-category	jni	Low
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.4	Low
Vendor	Manifest	bundle-symbolicname	com.sun.jna.platform	Medium
Vendor	Manifest	Implementation-Vendor	JNA Development Team	High
Vendor	Manifest	specification-vendor	JNA Development Team	Low
Vendor	pom	artifactid	jna-platform	Highest
Vendor	pom	artifactid	jna-platform	Low
Vendor	pom	developer email	mblaesing@doppel-helix.eu	Low
Vendor	pom	developer id	twall	Medium
Vendor	pom	developer name	Matthias Bläsing	Medium
Vendor	pom	developer name	Timothy Wall	Medium
Vendor	pom	groupid	net.java.dev.jna	Highest
Vendor	pom	name	Java Native Access Platform	High
Vendor	pom	url	java-native-access/jna	Highest
Product	file	name	jna-platform	High
Product	jar	package name	jna	Highest
Product	jar	package name	platform	Highest
Product	jar	package name	sun	Highest
Product	Manifest	automatic-module-name	com.sun.jna.platform	Medium
Product	Manifest	bundle-category	jni	Low
Product	Manifest	Bundle-Name	jna-platform	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.4	Low
Product	Manifest	bundle-symbolicname	com.sun.jna.platform	Medium
Product	Manifest	Implementation-Title	com.sun.jna	High
Product	Manifest	specification-title	Java Native Access (JNA)	Medium
Product	pom	artifactid	jna-platform	Highest
Product	pom	developer email	mblaesing@doppel-helix.eu	Low
Product	pom	developer id	twall	Low
Product	pom	developer name	Matthias Bläsing	Low
Product	pom	developer name	Timothy Wall	Low
Product	pom	groupid	net.java.dev.jna	Highest
Product	pom	name	Java Native Access Platform	High
Product	pom	url	java-native-access/jna	High
Version	file	version	5.19.1	High
Version	Manifest	Bundle-Version	5.19.1	High
Version	pom	version	5.19.1	Highest

Identifiers

pkg:maven/net.java.dev.jna/jna-platform@5.19.1 (Confidence:High)

jspecify-1.0.0.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Project/Scope: waffle-shiro:compile
pkg:maven/org.junit.jupiter/junit-jupiter-engine@6.1.3

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jspecify	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	jspecify	Highest
Vendor	Manifest	bundle-docurl	https://jspecify.dev/docs/start-here	Low
Vendor	Manifest	bundle-symbolicname	org.jspecify.jspecify	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	jspecify	Highest
Vendor	pom	artifactid	jspecify	Low
Vendor	pom	developer email	kevinb9n@gmail.com	Low
Vendor	pom	developer id	kevinb9n	Medium
Vendor	pom	developer name	Kevin Bourrillion	Medium
Vendor	pom	groupid	org.jspecify	Highest
Vendor	pom	name	JSpecify annotations	High
Vendor	pom	url	http://jspecify.org/	Highest
Product	file	name	jspecify	High
Product	jar	package name	annotations	Highest
Product	jar	package name	jspecify	Highest
Product	Manifest	bundle-docurl	https://jspecify.dev/docs/start-here	Low
Product	Manifest	Bundle-Name	JSpecify annotations	Medium
Product	Manifest	bundle-symbolicname	org.jspecify.jspecify	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	jspecify	Highest
Product	pom	developer email	kevinb9n@gmail.com	Low
Product	pom	developer id	kevinb9n	Low
Product	pom	developer name	Kevin Bourrillion	Low
Product	pom	groupid	org.jspecify	Highest
Product	pom	name	JSpecify annotations	High
Product	pom	url	http://jspecify.org/	Medium
Version	file	version	1.0.0	High
Version	Manifest	Bundle-Version	1.0.0	High
Version	Manifest	Implementation-Version	1.0.0	High
Version	pom	version	1.0.0	Highest

Identifiers

pkg:maven/org.jspecify/jspecify@1.0.0 (Confidence:High)

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

shiro-core-2.2.1.jar

Description:

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles        authentication, authorization, enterprise session management, single sign-on and cryptography services.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-core/2.2.1/shiro-core-2.2.1.jar
MD5: 3b83eaa1cf9fff4febadafc3a8dd1ea9
SHA1: 23d29cf0f69bd91049780b4d3b77e028a505abd3
SHA256:688489d58e00d40476e67be2cae8f349a6d51a21c0d16e4d856bcc6f6c9c2001
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/org.apache.shiro/shiro-web@2.2.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	shiro-core	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	shiro	Highest
Vendor	Manifest	automatic-module-name	org.apache.shiro.core	Medium
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	https://www.apache.org/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.shiro.core	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	shiro-core	Highest
Vendor	pom	artifactid	shiro-core	Low
Vendor	pom	groupid	org.apache.shiro	Highest
Vendor	pom	name	Apache Shiro :: Core	High
Vendor	pom	parent-artifactid	shiro-root	Low
Product	file	name	shiro-core	High
Product	jar	package name	apache	Highest
Product	jar	package name	session	Highest
Product	jar	package name	shiro	Highest
Product	Manifest	automatic-module-name	org.apache.shiro.core	Medium
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	https://www.apache.org/	Low
Product	Manifest	Bundle-Name	Apache Shiro :: Core	Medium
Product	Manifest	bundle-symbolicname	org.apache.shiro.core	Medium
Product	Manifest	Implementation-Title	Apache Shiro :: Core	High
Product	Manifest	specification-title	Apache Shiro :: Core	Medium
Product	pom	artifactid	shiro-core	Highest
Product	pom	groupid	org.apache.shiro	Highest
Product	pom	name	Apache Shiro :: Core	High
Product	pom	parent-artifactid	shiro-root	Medium
Version	file	version	2.2.1	High
Version	Manifest	Bundle-Version	2.2.1	High
Version	Manifest	Implementation-Version	2.2.1	High
Version	pom	version	2.2.1	Highest

Related Dependencies

shiro-cache-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-cache/2.2.1/shiro-cache-2.2.1.jar
- MD5: ac83e76d184dfb62204010de1c10b6cb
- SHA1: 2ad75e4aea6921cadfb35ecc734a58ddf712ea42
- SHA256: cf5bb8a3349165b34773abb17cc0e2e926cc292ce0a2f9b26af095ee2d376c8e
- pkg:maven/org.apache.shiro/shiro-cache@2.2.1
shiro-config-core-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-config-core/2.2.1/shiro-config-core-2.2.1.jar
- MD5: 21a7545ab9f9cf1b7b0c843ff0a84979
- SHA1: b25e12bdc24183e3a9a896009e97305b43ad0701
- SHA256: 7f64fe07e75d3afb48222d1020c6ab0e91445aa918fa852dd744802e3da2c72d
- pkg:maven/org.apache.shiro/shiro-config-core@2.2.1
shiro-config-ogdl-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-config-ogdl/2.2.1/shiro-config-ogdl-2.2.1.jar
- MD5: d0ba74ab0251da2c538cf704d1b00658
- SHA1: 5c10320334302891036e816daf951e040c63426f
- SHA256: 411b983dee3c7b7256c5140a1a4cd86b1004966e62029ec6e4a7795418bdb31a
- pkg:maven/org.apache.shiro/shiro-config-ogdl@2.2.1
shiro-crypto-cipher-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-cipher/2.2.1/shiro-crypto-cipher-2.2.1.jar
- MD5: 2b9854b97d52a833217160d34aeb84f2
- SHA1: 8dfe26beeb309d89d2dfbf2b8cce2d63d6882f32
- SHA256: f2c083d03eef731772b97728718d5ffeb71107ac0850c79b78283f8b1f29a193
- pkg:maven/org.apache.shiro/shiro-crypto-cipher@2.2.1
shiro-crypto-core-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-core/2.2.1/shiro-crypto-core-2.2.1.jar
- MD5: ccd62661f070a04684877e895e1f09f0
- SHA1: 8a1f005293319a68010203482a5d4d838f71f821
- SHA256: e8ac7be2365397dbc5f2b9dfad2a98941670202c612fd7e535afcefa7a503feb
- pkg:maven/org.apache.shiro/shiro-crypto-core@2.2.1
shiro-crypto-hash-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-crypto-hash/2.2.1/shiro-crypto-hash-2.2.1.jar
- MD5: bca90022c90dc05914e8401c4b0b1f4b
- SHA1: 525e45a85f809d021674558fcbe84c16c6df9390
- SHA256: 2ae3b681f6618ba56ff928255091d3ba72a364acdf0deebd55d4c4e093c3d7e8
- pkg:maven/org.apache.shiro/shiro-crypto-hash@2.2.1
shiro-event-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-event/2.2.1/shiro-event-2.2.1.jar
- MD5: df65381eb06c8d41057ab29bd0ebbc8f
- SHA1: 64a739820ef775d4b5d05ae8ef639c05d7d72058
- SHA256: 739446ee8581e13e670b8a27310e35902b8b8258e363e7bdd5f37758abbd86d7
- pkg:maven/org.apache.shiro/shiro-event@2.2.1
shiro-hashes-argon2-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/crypto/shiro-hashes-argon2/2.2.1/shiro-hashes-argon2-2.2.1.jar
- MD5: 2154316b03025bfbaa9ed98b66428c7a
- SHA1: ecb3e06966527c96e71466a5750fbe968b66853e
- SHA256: 2556fbf8ae5477679730a5cc1ba4aff223cc59d15879d64d43efd7cfdeb356cf
- pkg:maven/org.apache.shiro.crypto/shiro-hashes-argon2@2.2.1
shiro-hashes-bcrypt-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/crypto/shiro-hashes-bcrypt/2.2.1/shiro-hashes-bcrypt-2.2.1.jar
- MD5: 713956c7dd61cea72b74e0f5ec7a701a
- SHA1: 6eab5fb8d63fb2aeeac0a70285ea94ec26ecc6a1
- SHA256: a876b5934b74eac2ed0d4ca30fe8ed79052c1357c68ea36974dce32be15e77ec
- pkg:maven/org.apache.shiro.crypto/shiro-hashes-bcrypt@2.2.1
shiro-lang-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-lang/2.2.1/shiro-lang-2.2.1.jar
- MD5: 96a1747b0a95d8b7a08e339b3b87082b
- SHA1: da71729d2a052bd9dbecbc4df3e5931a839b98cd
- SHA256: a803f62e597b05d9550f0fd11943738442e4aa0d3f8432a430cd9bf3aef39ea9
- pkg:maven/org.apache.shiro/shiro-lang@2.2.1
shiro-web-2.2.1.jar
- File Path: /home/runner/.m2/repository/org/apache/shiro/shiro-web/2.2.1/shiro-web-2.2.1.jar
- MD5: 7ea1be5665e3cfa9fd5c42f936051322
- SHA1: 96cf3cd3cd9e5173e9a33eaf22a4bc4704019a51
- SHA256: 1129af8565d0bd9fe203a2894814ec937fa9230e0d04c6ab7b2f884b58fedcd7
- pkg:maven/org.apache.shiro/shiro-web@2.2.1

Identifiers

pkg:maven/org.apache.shiro/shiro-core@2.2.1 (Confidence:High)
cpe:2.3:a:apache:shiro:2.2.1:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.

Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. +
Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.

CWE-918 Server-Side Request Forgery (SSRF)

CVSSv4:

Base Score: MEDIUM (5.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:L/U:Amber

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* versions from (including) 2.0.0; versions up to (excluding) 3.0.1

slf4j-api-2.0.19.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit

File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.19/slf4j-api-2.0.19.jar
MD5: 1ca3a2acac3d5947b37d9b5536c55829
SHA1: efad9817997b3a6ce9e058f92e612917a744c290
SHA256:e91ff6d720609e7a194ffe758c3ed5c84e798617ae07b0a0f6a4fe229741b4bb
Referenced In Project/Scope: waffle-shiro:compile
pkg:maven/com.github.waffle/waffle-jna@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	slf4j-api	High
Vendor	jar	package name	slf4j	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	bundle-docurl	http://www.slf4j.org	Low
Vendor	Manifest	bundle-symbolicname	slf4j.api	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	slf4j-api	Highest
Vendor	pom	artifactid	slf4j-api	Low
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	name	SLF4J API Module	High
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	pom	url	http://www.slf4j.org	Highest
Product	file	name	slf4j-api	High
Product	jar	package name	slf4j	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	bundle-docurl	http://www.slf4j.org	Low
Product	Manifest	Bundle-Name	SLF4J API Module	Medium
Product	Manifest	bundle-symbolicname	slf4j.api	Medium
Product	Manifest	Implementation-Title	slf4j-api	High
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	slf4j-api	Highest
Product	pom	groupid	org.slf4j	Highest
Product	pom	name	SLF4J API Module	High
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	pom	url	http://www.slf4j.org	Medium
Version	file	version	2.0.19	High
Version	Manifest	Bundle-Version	2.0.19	High
Version	Manifest	Implementation-Version	2.0.19	High
Version	pom	version	2.0.19	Highest

Identifiers

pkg:maven/org.slf4j/slf4j-api@2.0.19 (Confidence:High)

spotbugs-annotations-4.10.4.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: /home/runner/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.10.4/spotbugs-annotations-4.10.4.jar
MD5: 472925cb4e5451c8f7a1aeeefe286622
SHA1: 7eb4c58212378becfb6ea6d236ec24a2352a316e
SHA256:28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3
Referenced In Project/Scope: waffle-shiro:provided
pkg:maven/com.github.waffle/waffle-shiro@3.6.1-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.8	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.10.4	High
Version	Manifest	Bundle-Version	4.10.4	High
Version	pom	version	4.10.4	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4 (Confidence:High)

How to read the report | Suppressing false positives | Getting Help: github issues

Project: waffle-shiro

com.github.waffle:waffle-shiro:3.6.1-SNAPSHOT

Summary

Dependencies (vulnerable)

bcprov-jdk18on-1.84.jar

Evidence

Identifiers

caffeine-3.2.4.jar

Evidence

Identifiers

checker-qual-4.2.3.jar

Evidence

Identifiers

com.github.waffle:waffle-jna:3.6.1-SNAPSHOT

Evidence

Identifiers

commons-beanutils-1.11.0.jar

Evidence

Identifiers

commons-logging-1.3.5.jar

Evidence

Identifiers

encoder-1.4.0.jar

Evidence

Identifiers

error_prone_annotations-2.50.0.jar

Evidence

Identifiers

j2objc-annotations-3.1.jar

Evidence

Identifiers

jakarta.servlet-api-4.0.4.jar

Evidence

Identifiers

jna-5.19.1.jar

Evidence

Identifiers

jna-5.19.1.jar: jnidispatch.dll

Evidence

Identifiers

jna-5.19.1.jar: jnidispatch.dll

Evidence

Identifiers

jna-5.19.1.jar: jnidispatch.dll

Evidence

Identifiers

jna-platform-5.19.1.jar

Evidence

Identifiers

jspecify-1.0.0.jar

Evidence

Identifiers

jsr305-3.0.2.jar

Evidence

Identifiers

shiro-core-2.2.1.jar

Evidence

Related Dependencies

Identifiers

Published Vulnerabilities

slf4j-api-2.0.19.jar

Evidence

Identifiers

spotbugs-annotations-4.10.4.jar

Evidence

Identifiers